Security audit
Security checks for vulnerabilities and agentic risk
This skill can spend account credits without fresh approval and can incorrectly describe paid execution as quotation-only.
Before use, set the account to ask before every charge and approve recurring collection costs separately. Use the dedicated quote command for estimates; omitting --confirm does not reliably prevent spending. The contradictory confirmation promises and deepdive reporting defect should be corrected.
scripts/ari.pyQuote-only deepdive inherits automatic paid execution
Paid VOC analysis can be generated and account credits deducted during an operation documented as quotation-only. The missing-subscription branch can additionally report that no credits were deducted even though automatic generation was reached.
The benchmark-specific entry point incorporates a general review-intelligence workflow that can collect data and spend credits without transaction-specific approval under server defaults. This is more than feature expansion: users selecting a free benchmarking skill can encounter materially broader financial side effects, although several other operations correctly require consent.
The declared purpose describes category comparisons and rankings, not ongoing scheduled monitoring or watch lifecycle management. Although competitor monitoring is related to competitive positioning, persistent weekly watches with per-refresh pricing are materially additional capabilities rather than supporting details of a ranking lookup. The supplied chunk contains command examples rather than proof of execution, but the operations it exposes are not adequately represented by the description.
The supplied commands perform product-level review retrieval and do not request category comparisons, relative rating positions, negative-review-rate benchmarks, or leaderboards. Although reviews could support benchmarking internally, this chunk exposes review retrieval directly without showing any connection to the declared benchmarking workflow. This assessment is limited to the supplied commands; the implementation of scripts/ari.py is not provided.
The declared purpose describes viewing benchmarks and rankings, not configuring recurring monitoring or automatic collection that may generate ongoing charges. These scheduling controls are a distinct, state-changing capability rather than merely an implementation detail of displaying benchmark results. The underlying Python implementation is not supplied, so the assessment is limited to the scheduling commands and their stated effects.
The declared purpose concerns category-level comparisons and rankings, whereas the supplied chunk exposes lifecycle management and reporting for recurring product watches. Scheduled monitoring and its per-refresh pricing are material capabilities not disclosed by the description, rather than merely supporting implementation details. The implementation of scripts/ari.py is not supplied, so backend execution and billing cannot be independently verified.
声明描述的是类目对标查询和付费排行榜，而代码片段展示的是周期性监控任务的生命周期管理。即使竞品监控与竞争定位有关，持续调度及带价格接受参数的刷新仍属于未声明的实质性能力，并非对标查询的普通实现细节。片段未展示底层实现，因此不能据此确认任务已执行或费用已产生。
The competitor-binding instruction says that adding a competitor starts weekly automatic collection, without explicitly requiring a recurring-cost quote and approval for that binding action. This creates an ambiguity in which authorization for a one-time comparison could be treated as authorization for ongoing collection, despite general safeguards elsewhere.
The supplied commands operate on an existing watch and retrieve monitoring outputs, rather than requesting category benchmarks or rankings. These monitoring capabilities are not disclosed in the description, and the snippet provides no connection establishing them as supporting steps for category comparisons. The underlying script is not supplied, so this assessment is limited to the visible command invocations.
The embedded VOC workflow is outside category benchmarking and explicitly permits collection and analysis charges before discussing price when server auto-confirmation applies. A request for review analysis is not necessarily authorization for an undisclosed charge, especially where the default first-run policy has no amount limit.
The supplied commands concern a watch or monitoring service, which is not disclosed in the category-benchmarking description. The chunk shows no category ranking, star-rating comparison, or negative-review-rate comparison. This assessment is limited to the visible command invocations; their underlying implementation is not provided.
The supplied commands concern watch monitoring and its pricing, which are not described by the declared benchmarking and category-ranking purpose. They appear to expose a separate user-facing capability rather than merely implement benchmarking. The underlying ari.py code is not supplied, so further behavior or side effects cannot be established.
The command explicitly selects operations quote --workflow audit --focus full. This targets an audit workflow, not the category comparison or leaderboard functions described. Quoting could support paid functionality, but the workflow being quoted differs from the declared purpose. The supplied chunk does not establish that an audit is executed or that any payment occurs.
The supplied command targets an individual review through advise --review-id, while the description promises category-level comparisons and leaderboards. This is a materially different exposed operation. The implementation of ari.py is not provided, so the exact advice produced, the meaning of confirmation, and any resulting side effects cannot be established.
The supplied command selects an alerts operation rather than an explicitly described benchmarking or ranking operation. This indicates an undeclared capability. However, the implementation of scripts/ari.py is not provided, so the exact alert behavior, accessed resources, and side effects cannot be verified.
The visible command explicitly selects '--workflow audit --focus full', which is not described in the declared benchmarking purpose. It does not explicitly request category comparisons or rankings. The underlying script is not supplied, so the audit's exact scope and any side effects cannot be established; the finding is limited to the apparent workflow mismatch.
The supplied command explicitly selects a deepdive operation, not a category benchmark or leaderboard operation. This indicates a capability outside the declared scope. However, scripts/ari.py is not supplied, so the exact analysis, API requests, and meaning of --confirm cannot be verified; no specific billing or data-access behavior is established by this snippet.
The instruction explicitly converts an unanswered quote and an idle product into grounds to generate a report in a later conversation. Silence is not spending authorization, and server auto-confirmation can turn this unsolicited continuation into an actual deduction from the user's balance.
run_analysis replaces missing local confirmation with a server-provided autoConfirm value, allowing a command expected to return a quote to spend account credits. cmd_voc similarly permits collection and analysis without --confirm, and deepdive's supposed quote-only downgrade can be bypassed through run_analysis; availability in this specialized package depends on the unprovided command allowlist.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.