Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly discloses its ARI API use and paid confirmation flow, but its code can run broader server-defined product-operation workflows than the fixed FAQ purpose promises.
Review this before installing if you need strict FAQ-only behavior. Do not approve paid operations unless the quote clearly shows the intended listing/faq task, and avoid passing custom --workflow or --focus values. The ARI API key will be stored locally or read from the environment and used with the official ARI service.
The skill claims to be a narrowly scoped FAQ suggestion tool, but it also exposes account setup, API key configuration, balance checks, paid data collection, and broader operations commands. This mismatch can mislead users about the actual trust boundary and cost/account effects, increasing the risk of unintended credential handling, billable actions, and broader data access than the description suggests.
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The code builds server-facing payloads with user-supplied or defaulted workflow/focus values and then executes '/product-operations/run', allowing the server to select and perform broader product-operation workflows beyond FAQ suggestion. Even though there is a quote/confirm gate, this still grants a declared FAQ-only skill the ability to invoke arbitrary server-defined analyses, expanding trust to opaque remote behavior outside the advertised purpose.
The skill is घोषित as FAQ-topic generation from reviews and product fields, but this file exposes a broader 'operations' command set for generic product-operations analysis, including capability discovery, profile reads, quoting, execution, and status polling. That scope expansion violates least privilege and creates a hidden feature surface that could trigger non-FAQ analyses and paid actions users did not expect from this skill.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
The example invocation hard-codes '美国站' (US site), which can steer use toward a specific locale. The README does not present this as an optional example alongside user-selectable locale choices in the natural-language entrypoint.
The user-facing strings in the manifest are entirely in Chinese, which implies a fixed language experience without any stated user opt-in or documented locale restriction. Per the policy, forcing a specific language is a natural-language policy concern unless the skill offers a choice or clearly explains that it is region- or language-specific.
The entire skill description is written in Chinese and the title explicitly targets an Amazon product FAQ operations workflow in Chinese, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill imposes a specific language experience without opt-in or documented justification.
The reference documentation is entirely written in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
This code hard-codes Chinese-language error text and directs users to /zh pages, and the same pattern continues throughout the CLI. That creates a language/locale policy issue because the skill does not offer the user any language choice or opt-in before enforcing a specific locale.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
emit({"success": True, "data": collection_quote(plan), "links": links()}, args.compact)
return
emit(execute_collection(plan, args.wait, args.interval, args.timeout), args.compact)
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
def cmd_status(args):
emit(request_json("GET", "/api/v1/collection/status/" + urllib.parse.quote(args.task)), args.compact)
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
def cmd_operation_status(args):
request_id = urllib.parse.quote(args.request_id.strip(), safe="")
emit(request_json("GET", "/api/v1/product-operations/runs/" + request_id), args.compact)
This markdown file is written entirely in Chinese and does not indicate that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy concern.
This manifest provides only a display name and broad functional description, but it does not specify when the skill should or should not be invoked, nor does it list explicit trigger phrases or exclusions. In a manifest file, that lack of specificity can make activation boundaries ambiguous and increase the chance of unintended invocation.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
所以校验不能写死 B 前缀。顺手把值归一成大写，后续命令不必再 upper()。
"""
for attr in ("asin", "competitor"):
value = getattr(args, attr, None)
if value in (None, ""):
continue
normalized = str(value).strip().upper()
整份技能说明仅以中文提供，并在示例触发语和使用步骤中默认要求用户以中文交互，未见提供其他语言选项或明确说明该技能仅面向中文用户。根据语言/locale 政策，这属于未提供用户选择的语言约束。