Security audit
Security checks for vulnerabilities and agentic risk
This readability checker includes broader account controls and can spend credits despite its promised confirmation steps.
Prefer a corrected readability-only release with enforced scope and payment confirmation. If using this version, select account settings that require confirmation for every charge, request manual collection, review recurring schedules, and avoid deepdive for quote-only requests.
scripts/ari.pyQuote-only deepdive calls can silently become paid analysis
A data-inspection or quote-only deepdive can consume account credits without the command-specific authorization promised to the caller. When the main-product record is absent and --confirm was supplied, the resulting productNote can additionally claim that no charge occurred despite the paid helper having run.
The readability-only skill includes actionable general-purpose workflows that can spend credits, change account settings, and establish recurring collection. Its final fixed-entry restriction conflicts with earlier instructions to execute broader paid workflows automatically, creating a credible authorization and scope-confusion risk.
Recurring main-product and competitor monitoring expands a one-time readability task into persistent account activity. Although the watch workflow requires price acceptance, including executable monitoring instructions contradicts the package's fixed scope and weakens isolation against unintended workflow selection.
The competitor workflow states that binding a competitor causes automatic weekly collection, without explicitly requiring separate consent to that recurring side effect. A user authorizing a one-time comparison could therefore acquire ongoing collection and potential charges beyond the requested readability task.
The skill exposes persistent monitoring lifecycle actions despite declaring a readability-only operational boundary. Explicit price confirmation and deletion checks reduce the danger, but the conflicting instructions still give the agent an out-of-scope path to persistent account changes and recurring charges.
Persistent watch creation and resumption conflict with the skill's fixed readability-only entry point and can create continuing financial obligations. Mandatory quote acceptance materially limits exploitation, so this is a scope-isolation weakness rather than evidence of an unconditional billing bypass.
The document introduces scheduled collection and a weekly default into a skill that should only perform a confirmed readability assessment. Instructions to use manual collection without recurring authorization are protective, but the unnecessary scheduling surface and conflicting general workflows leave room for unintended continuing charges.
The visible command requests a category ranking, which is materially different from evaluating a Listing's readability. Although reviews are within the declared scope, ranking a category by negative rate is not a readability diagnostic or an evident supporting step. The script implementation is not supplied, so the command does not establish specific network access, publishing, or other side effects.
The supplied commands expose watch and pricing functionality that is not described in the declared readability-only purpose. The chunk contains no readability analysis. Because the underlying ari.py implementation is not supplied, this assessment is limited to the visible command invocations and their annotation; it does not establish what resources they access or whether they change any settings.
Watch management and monitoring-cost queries are not disclosed in the readability-diagnosis description, and the supplied chunk does not establish them as necessary supporting implementation details. The snippet does not show creation of watches, incurred charges, or automated publishing; the mismatch is limited to the watch quotation and listing capabilities it explicitly invokes.
The supplied commands expose watch-monitoring and historical reporting functionality rather than directly analyzing listing readability. The description does not disclose this monitoring capability, and the snippet provides no connection between the watch outputs and the stated diagnostic task. The underlying CLI implementation is not supplied, so this assessment is limited to the visible commands; it does not imply that they create watches, publish content, or perform advertising.
Unlike optional unrelated queries, alerts are explicitly requested automatically at session startup. This can bring unrelated account-level negative-review information into a readability conversation without task-specific need, creating a limited data-minimization and scope-boundary weakness.
The standard workflow instructs the agent to execute VOC without an initial quote and permits credits to be deducted before discussion of cost. This directly conflicts with the specialized entry point's requirement for quotation and explicit payment confirmation, enabling unintended paid execution if the broader workflow is selected.
The skill explicitly treats an unanswered earlier quote as an opportunity to generate the report in a later conversation when server auto-confirmation applies. Silence is not payment authorization, and an idle product record does not establish current intent to purchase a report.
Recurring price and sales-rank monitoring is a persistent paid capability unrelated to the fixed readability workflow. Quote and consent requirements lower the risk, but embedding this alternate operational path undermines the specialized skill's scope boundary.
The documented collection default is weekly monitoring, so a bounded readability assessment can create recurring paid activity unless the agent explicitly selects manual collection. Confirmation of an initial collection does not necessarily authorize future charges, and the earlier cost-disclosure guidance does not reliably address this implicit default.
run_analysis converts an unconfirmed invocation into a paid execution based on a server-supplied autoConfirm value, contradicting the explicit --confirm contract. cmd_voc extends this behavior to collection plus analysis, and deepdive can therefore perform paid analysis even when intended to return only a quote.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):