Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because supposedly quote-only checks can trigger paid analysis, and its recurring monitoring exceeds its stated listing-checking scope.
Prefer a corrected release that reliably preserves quote-only requests and enforces the promised listing-checking scope. If you proceed, select ARI's “ask every time” setting, use manual collection for one-time work, and review recurring schedules and competitor monitoring.
scripts/ari.pyRecurring collection can be enabled without an enforced confirmation gate
The user's account can incur recurring collection charges without an execution-path check that the user accepted them.
scripts/ari.pydeepdive's quote-only fallback can execute paid analysis
A quotation-only deepdive can consume account credits. In the missing-product branch, contradictory no-charge messaging can also conceal the unexpected charge from the caller.
The document combines a narrowly scoped, confirmation-required promise-checking entry point with generic instructions to generate VOC reports and spend credits without first confirming a price. These contradictory execution paths can lead an agent to perform chargeable work outside the selected skill's authorization boundary, although the final fixed-entry section provides a mitigating instruction.
声明限定为 Listing 承诺与评论证据的一致性核查，但所示命令暴露了有状态、周期性的监控管理能力，并涉及刷新价格确认。这些能力超出一次性证据核查的支持性实现细节，且未在声明中披露。片段未展示实际执行结果，因此不能确认任务已创建或费用已产生；但所提供命令的功能与声明仍存在实质性不一致。
The competitor-comparison instructions introduce competitor binding that automatically triggers weekly collection without explicitly requiring separate consent to that recurring activity. Authorization for a one-time comparison does not necessarily authorize ongoing collection charges, and this shortcut conflicts with the document's broader recurring-consent rules.
The declared scope is listing-claim evidence checking, but the supplied commands expose recurring monitoring and watch-management operations that are not disclosed in that scope. Scheduling ongoing refreshes and accepting their pricing are material capabilities, not merely implementation details of a single evidence check. No claim extraction, review comparison, or evidence-gap analysis is visible in the supplied chunk.
The declared scope is limited to comparing listing promises with review evidence. The supplied command examples instead expose a recurring monitoring workflow, including competitor tracking and paid refresh authorization, without showing claim-to-review verification. These are substantive capabilities not disclosed by the description, rather than merely supporting implementation details. Because this chunk contains command examples rather than implementation code, it does not establish that any watch was actually created or any charge incurred.
The supplied command requests a category ranking and supplies no listing claims or evidence-comparison task. This is a materially different analytical operation from the narrowly declared purpose. The underlying script is not provided, so the effects of --confirm and any additional data access or side effects cannot be established.
监控报价与监控列表查询属于声明中未披露的能力，并非所述承诺与评论证据核查的直接实现。片段没有展示 Listing 承诺提取、评论比对或证据缺口标记。此判断仅针对提供的命令；不能据此认定代码会启用监控、产生收费或自动发布。
Review collection can support evidence verification, but configuring ongoing, potentially chargeable monitoring adds a persistent operational capability not disclosed in the description. The chunk shows schedule management rather than claim-versus-review analysis. It does not show automatic publishing or legal analysis, so those exclusions are not contradicted.
The supplied commands concern watch management and pricing rather than comparing listing promises with review evidence. These capabilities are not declared, and the snippet does not establish them as necessary supporting steps for the stated evidence-checking task. It does not show watch creation, automatic publishing, or the underlying API implementation.
命令中的 --type compare 和 --competitor 明确指向竞品比较，超出了所声明的单一承诺证据核查用途。该代码片段未展示底层脚本，因此无法确认比较的具体内容，也没有依据认定存在自动发布、法律合规判断或其他行为。
The supplied commands provide watch-reporting functionality rather than visibly comparing Amazon listing promises with review evidence or identifying evidence gaps. This is a mismatch in the functionality presented by the chunk. The implementation of scripts/ari.py is not supplied, so underlying data sources, API-key handling, and any additional analysis cannot be verified.
The default workflow instructs the agent to invoke a potentially chargeable VOC command before quoting and to disclose spending only after generation. That conflicts with this specialized skill's explicit-confirmation requirement and can consume user credits based on service defaults rather than informed authorization.
The document directs the agent to revive an unanswered quote in a later conversation and generate the report if automatic confirmation permits it. Silence on an earlier quote is not consent, and an idle product record does not establish current authorization to spend credits.
run_analysis changes an absent local confirmation into approval when the server returns sufficient and a truthy autoConfirm value, then proceeds to a paid endpoint. This violates the documented explicit --confirm boundary and also affects callers such as deepdive; cmd_voc contains a similar bypass that can authorize both collection and analysis.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
Automatic execution is permitted not only for user-set spending thresholds but also for service-defined first-use and remaining-use exemptions without an amount limit. These exemptions can authorize credit consumption without the user's informed acceptance and conflict with the specialized entry point's confirmation requirement.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
The instruction delegates the decision to spend to the response's autoConfirm field even when that field reflects service defaults rather than a user-approved budget. A service eligibility decision cannot substitute for authorization to consume the user's credits.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。
The agent is told to run a command that may already generate and charge before any price confirmation, then discuss money afterward. Post-execution disclosure cannot repair missing authorization, especially where this skill otherwise promises mandatory pre-execution confirmation.
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
**返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
（1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
**不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**
The instructions route advertising and Search Terms requests to keyword analysis that produces long-tail terms, negative-keyword candidates, competitor-brand terms, and a ready-to-use backend Search Terms string. Producing marketing material is not checking whether listing claims are supported by review evidence, and conflicts with the manifest's express exclusion of free-form creation.