Amazon 商品 FAQ 建议

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:35 AM UTC
• Version: 1.4.8

Overview

The skill is not clearly malicious, but it exposes a much broader paid ARI operations tool than its FAQ-focused name suggests and can spend credits or change account behavior.

Install only if you intend to give this skill access to your ARI account and are comfortable with paid review-analysis workflows, local API-key storage, and persistent ARI settings. Before using it, set autoconfirm off if you want every charge approved first, use “只报价，不执行” for estimates, and avoid invoking the broader monitoring, export, workbench, advise, or leaderboard features unless you deliberately want them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:145
• Finding: Mandatory Vendor Link and Promotional Text Injection into Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 145-147 and 230-231 **Vulnerability Type**: Forced modification of the agent's final response **Risk Level**: High ### Vulnerable Code Snippet ```markdown **网页链接的用法** - 每份报告末尾附 `web.report`，措辞是「网页版有健康度图表和频次表，可生成分享链接与海报」——是补充，不是「建议你去网页」。 - 用户要把报告发给同事/发群：指向网页报告页的「分享」按钮，不要把整篇 Markdown 贴给他转发。 ``` ```markdown **输出含 `reportUrl` 时必须在结尾附上**， 固定文案：「在线查看图表版完整报告 / 导出：<reportUrl>」（需登录报告所属账户）。 ``` The source text requires the agent to append an ARI report link and fixed vendor-selected wording to generated reports. In English, the mandated wording promotes the online graphical report and export page and requires it to appear at the end of the response. ### Technical Analysis The Skill instructions do more than describe how to access an optional result. They impose a mandatory placement rule and fixed promotional wording whenever a `reportUrl` is present. This constitutes instruction-level output hijacking because loading the Skill causes the agent to modify its final response according to the vendor's promotional requirements, even when the user did not request an online report, sharing page, or export link. The directive is reinforced by a separate instruction requiring every report to include the vendor's web-report reference. The affected behavior is not necessary to perform the declared FAQ extraction and review-analysis functionality. A report URL can be returned as optional structured metadata without forcing promotional prose into the agent's user-facing answer. ### Attack Path 1. The agent loads and follows `SKILL.md`. 2. The agent invokes the ARI service to generate or retrieve a report. 3. The service response contains a `reportUrl`. 4. The Skill instructions require the agent to append fixed vendor wording and the external report URL. 5. The final answer is altered to include vendor-directed promotional content regardless of whether the user requested it. 6. The user may consequen ...[truncated 604 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all mandatory wording and placement requirements for `reportUrl`. 2. Return the URL only as structured result metadata. 3. Include the URL in prose only when the user explicitly requests an online report, export, sharing feature, or graphical view. 4. Replace fixed promotional language with a neutral optional statement, such as: “An online report URL is available on request.” 5. Ensure the core FAQ or review-analysis result remains complete without requiring navigation to an external website. 6. Add an instruction that user preferences concerning response length, links, and external navigation take precedence over optional service-link presentation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ari.py:300
• Finding: Bearer API Key Is Not Protected by an Explicit Same-Origin Redirect Policy<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py`, lines 300-320; equivalent behavior also occurs at lines 337-350 and 1444-1460 **Vulnerability Type**: Potential credential disclosure through authenticated HTTP redirects **Risk Level**: Medium ### Vulnerable Code Snippet ```python def request_json(method, path, payload=None, params=None): query = { "method": method, "path": path, "params": {k: v for k, v in (params or {}).items() if v not in (None, "")}, "payload": payload, } url = base_url() + path if query["params"]: url += "?" + urllib.parse.urlencode(query["params"], doseq=True) data = None if payload is None else json.dumps(payload).encode("utf-8") headers = { "Authorization": "Bearer " + require_key(), "Accept": "application/json", "User-Agent": user_agent(), } if data is not None: headers["Content-Type"] = "application/json" try: req = urllib.request.Request(url, data=data, headers=headers, method=method) with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp: ``` The same authenticated `urlopen` pattern is used by the SSE and download request paths: ```python headers = { "Authorization": "Bearer " + require_key(), "Accept": "text/event-stream", "Content-Type": "application/json", "User-Agent": user_agent(), } result = {"meta": None, "content": "", "result": None, "reportId": 0, "creditsUsed": 0} try: req = urllib.request.Request( url, data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST") with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp: ``` ```python headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()} try: req = urllib.request.Request(url, headers=headers, method="GET") with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp: ``` ### Technical Analysis The code attaches the user's ` ...[truncated 2360 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic redirects for every authenticated request. 2. If redirects are required, implement a custom redirect handler that: - Allows only HTTPS destinations. - Requires the exact approved hostname and port. - Rejects HTTPS-to-HTTP downgrades. - Rejects user-information components in redirect URLs. - Enforces a small redirect-count limit. 3. Strip the `Authorization` header unconditionally before any cross-origin redirect. 4. Reconstruct authenticated requests only after validating the redirect destination against an explicit origin allowlist. 5. Apply the same policy consistently to JSON, SSE, and download requests. 6. Add automated tests covering: - Same-origin redirects. - Cross-origin redirects. - HTTPS-to-HTTP redirects. - Redirect loops. - Redirects from opted-in custom API origins. 7. Log redirect rejection without including the API key or other authorization-header contents. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises no explicit permissions, yet its documented behavior clearly requires shell execution, network access, environment access, and local file writes for setup, key storage, and CLI operations. That mismatch is dangerous because users and hosting platforms cannot accurately evaluate the trust boundary, while the skill is capable of handling credentials and initiating billable external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is a narrow FAQ generator, but the instructions authorize a much broader operational toolchain: credential setup, paid collection, report generation, scheduling, monitoring, exports, competitor management, and automated analysis workflows. This description-behavior gap materially increases risk because a user invoking a seemingly limited FAQ skill may unknowingly trigger account changes, data collection, or charges well beyond the stated scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it is only for FAQ topic suggestion, but this file implements broad product-operations workflows, monitoring, and report-generation capabilities well beyond that scope. Scope creep in an agent skill is dangerous because it increases the chance the agent will perform unintended paid, operational, or decision-making actions using the user's credentials under the guise of a narrow FAQ tool.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The skill includes an AI 'advise' feature that generates customer-response or handling suggestions for reviews, despite the metadata explicitly stating it must not be used for customer service auto-replies. In an agent context, this mismatch can cause unauthorized customer communication workflows, off-policy messaging, and paid actions outside the user's intended consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Watch, alerts, workbench, leaderboard, benchmark, export, and related monitoring/workflow features are materially broader than FAQ-topic extraction from reviews. In an agent environment, this broad operational surface creates unjustified access to account actions, historical data, and paid/ongoing workflows that a user would not reasonably expect from a FAQ generator.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module docstring claims paid collection and AI analysis require an explicit --confirm flag, but later logic auto-confirms some paid operations based on server-returned policy. Security-relevant documentation mismatches are dangerous because agent orchestrators and users may rely on the stated requirement and unknowingly trigger chargeable actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documentation describes capabilities far beyond the manifest’s stated scope of generating FAQ-topic suggestions, including broad review intelligence, monitoring, exports, operational audits, paid workflows, and AI-generated review replies. This scope mismatch can cause an agent or user to invoke sensitive or costly actions under false expectations, increasing the risk of unauthorized data processing, billing, or policy-violating automation.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The skill metadata says it is not for customer-service auto replies, yet the documentation later instructs use of a command that generates AI replies for negative reviews. This contradiction weakens safety boundaries and may lead the agent to produce or operationalize customer-facing responses in a context explicitly declared out of scope, creating compliance, trust, and misuse risks.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default prompt broadly instructs the model to use the skill without defining when it should or should not be invoked, what inputs are acceptable, or what safety boundaries apply. This can cause over-broad activation and inappropriate use of Amazon review content for contexts beyond FAQ suggestion, increasing the chance of misuse or policy bypass through prompt steering.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The metadata is entirely Chinese-facing and implicitly biases output language without any indication that language should follow user preference. While not a direct exploit primitive, this can mis-handle user intent, reduce transparency, and cause the skill to activate in a language the user did not request, which is a security-relevant reliability issue in multilingual agent workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to proceed with paid VOC generation when the backend marks the request as auto-confirmed, even if the user has not given transaction-specific confirmation in the conversation. This is dangerous because it normalizes delegated spending authority to a remote service policy, creating a real risk of surprise charges or actions outside the user's immediate informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 95% confidence
• Finding: The documented flow moves directly from user intent to running billable commands and automatic collection/waiting behavior, with confirmation only when the backend says it is required. That makes the agent an autonomous purchasing actor and can cause unreviewed spending or external side effects under ambiguous user requests.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 94% confidence
• Finding: The skill repeatedly tells the agent to directly generate outputs and incur charges whenever autoConfirm is true, rather than requiring explicit approval for each paid action. In a skill handling external billing and persistent account effects, that delegation materially increases the likelihood of unauthorized or unexpected charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 90% confidence
• Finding: The same account-level autoconfirm setting change appears as a separate autonomous-decision concern because it delegates future authorization decisions to an agent-managed threshold. This is risky in any environment where the skill can be invoked conversationally, since a single ambiguous instruction could lower consent barriers for later charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 90% confidence
• Finding: The same account-level autoconfirm setting change appears as a separate autonomous-decision concern because it delegates future authorization decisions to an agent-managed threshold. This is risky in any environment where the skill can be invoked conversationally, since a single ambiguous instruction could lower consent barriers for later charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**
- 报告讲完只推一个下一步，附接口返回的成本，不写死月费用。用户同意再 `schedule --set weekly`。
- 不解释命令名，不列功能清单。用户问「还能做什么」时按他的产品状态给一条建议，不超过三句。

• Confidence: 83% confidence
• Finding: Tailoring next actions based on `autoConfirm.mode` encourages the agent to infer spending behavior and steer users into follow-on billable workflows with minimal friction. In context, this makes the broader autonomous billing pattern more dangerous because it operationalizes account policy as a trigger for agent-initiated monetized actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch delete` | product-operations/watches/{id}（DELETE） | 否；不删除商品资料、评论或历史报告 |
| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |

• Confidence: 94% confidence
• Finding: The documentation explicitly permits `analyze` to execute paid operations when server-side `autoConfirm` rules are met, meaning the agent may trigger billable actions without an explicit per-action user confirmation. In an agent setting, autonomous execution of paid or state-changing operations increases the risk of unintended charges and weakens human approval boundaries.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: This duplicate finding is still valid: exposing `autoconfirm` as a configurable feature creates a standing permission model that can bypass normal approval checks for subsequent operations. That is risky in an automated agent context because it shifts control from explicit user intent to background policy.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: This duplicate finding is still valid: exposing `autoconfirm` as a configurable feature creates a standing permission model that can bypass normal approval checks for subsequent operations. That is risky in an automated agent context because it shifts control from explicit user intent to background policy.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 96% confidence
• Finding: This section states that VOC generation may directly proceed under server-side auto-confirm rules and automatically complete collection, waiting, analysis, and archiving. That creates a concrete pathway for an agent to initiate multi-step billable work without explicit approval at execution time.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 95% confidence
• Finding: The quote response includes `autoConfirm` and related fields that may be interpreted by the agent as authorization to proceed. In practice, exposing this as an execution signal encourages autonomous billable behavior and undermines the safer pattern of quote-then-user-approve.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 95% confidence
• Finding: This duplicate finding is valid because the documentation normalizes immediate execution under `autoConfirm`. The surrounding context makes it more dangerous in an agent skill because the system is specifically designed to orchestrate commands on the user's behalf.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 95% confidence
• Finding: This duplicate finding is valid because the documentation normalizes immediate execution under `autoConfirm`. The surrounding context makes it more dangerous in an agent skill because the system is specifically designed to orchestrate commands on the user's behalf.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 94% confidence
• Finding: The `autoConfirmNote` and related fields can further legitimize autonomous execution by presenting it as an approved workflow. While informative for humans, in an agent environment this metadata can be misused to skip consent and silently consume credits.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 94% confidence
• Finding: This additional duplicate points to the same core weakness: the skill allows server-side policy to substitute for explicit user approval in paid workflows. That is not remote code execution, but it is still a meaningful security/control issue involving unauthorized economic actions.

Static analysis

No suspicious patterns detected.