Security audit

亚马逊Listing优化 · 评论驱动文案

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ARI Amazon review-analysis skill, but it can spend ARI credits automatically under server-side auto-confirm rules and persist account confirmation settings.

Install only if you are comfortable granting this skill access to your ARI account and sending product/review data to ari.funewa.com. Before using paid workflows, consider setting the ARI confirmation mode to always ask, and use 'only quote, do not execute' when you want pricing without charges.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (73)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The script performs extensive authenticated network operations to ari.funewa.com, including account, billing, collection, monitoring, and paid analysis endpoints. In a skill presented as listing optimization, undeclared network reach materially increases risk because it can transmit user queries, commercial data, and bearer-token-authenticated actions to a remote service without permission transparency.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The script performs extensive authenticated network operations to ari.funewa.com, including account, billing, collection, monitoring, and paid analysis endpoints. In a skill presented as listing optimization, undeclared network reach materially increases risk because it can transmit user queries, commercial data, and bearer-token-authenticated actions to a remote service without permission transparency.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The script performs extensive authenticated network operations to ari.funewa.com, including account, billing, collection, monitoring, and paid analysis endpoints. In a skill presented as listing optimization, undeclared network reach materially increases risk because it can transmit user queries, commercial data, and bearer-token-authenticated actions to a remote service without permission transparency.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, and nowhere indicates that the language is optional, selectable, or limited to a specific regional audience. Under the language/locale policy rule, forcing a single language without user opt-in is a policy concern even when it appears in documentation such as a changelog.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.
md
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/ari.py (reported line 673)May include surrounding context.
python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/ari.py (reported line 675)May include surrounding context.
python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/ari.py (reported line 1805)May include surrounding context.
python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/ari.py (reported line 1806)May include surrounding context.
python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/ari.py (reported line 1808)May include surrounding context.
python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、 `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、 `voc` / `analyze` / `charts` / `deepdive` 等母版命令。 - 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire README instructs the user in Chinese and provides only Chinese example prompts such as at L10 and L20, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description says to use the skill when the user asks about broad topics like listing optimization, copywriting from reviews, title optimization, and rewrite requests. These phrases are common across many ordinary e-commerce assistance requests and the file does not provide negative examples or clear limits for when this skill should not activate versus other related skills.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The skill instructs the agent to default to running a VOC command that may immediately generate a paid report under server-side auto-confirm rules, without obtaining an explicit per-action confirmation from the user in the current interaction. That creates a real risk of autonomous spending and execution of billable actions based on inferred intent rather than fresh, explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。 2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。 **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote` （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。** 3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

Static analysis

No suspicious patterns detected.