Security audit
Security checks for vulnerabilities and agentic risk
This research skill needs review because commands advertised as previews can spend account credits, and its account controls exceed its stated scope.
Prefer a corrected package that enforces its fixed research scope and guarantees non-charging previews. Before use, set ARI to require confirmation for every charge, use quote for estimates, and avoid deepdive as a preview. Choose manual collection unless you approve recurring costs.
scripts/ari.pyQuote-only deepdive can execute paid analysis without confirmation
A user or Agent relying on the documented preview behavior can consume account credits and generate an archived report without authorizing that execution. The missing-subscription branch can also misleadingly claim that analysis was downgraded to a quote.
The document combines a fixed, quote-first market-entry workflow with generic instructions permitting other workflows and automatic paid report generation. This creates a concrete authorization ambiguity: an agent can follow the generic instructions and spend credits without the explicit confirmation required by this specialized skill, although several other listed capabilities have their own consent safeguards.
The declared scope is limited to pre-entry evidence research, but the supplied commands provide a persistent, scheduled monitoring workflow rather than merely collecting evidence for that research. Watch management and recurring priced refreshes are material capabilities absent from the description. The ASIN and competitor resources are consistent with the declared subject matter, and the chunk does not establish that any prohibited forecasting occurs. The mismatch concerns the additional monitoring and recurring-operation capabilities.
The supplied command targets an entire product category and requests a ranked leaderboard, an analytical capability not disclosed in the description. It specifies neither a main ASIN nor authorized competitors and does not request the declared research outputs. The mismatch concerns scope and capability; the command alone does not establish sales, profit, or return-rate forecasting.
The supplied commands manage persistent, weekly monitoring and include price-acceptance options. These are material operational and financial capabilities not disclosed by the description of evidence-based pre-entry research. Monitoring the same ASINs is related to the stated subject matter, but recurring watch management is more than a supporting implementation detail. The snippet does not establish that any prohibited forecasting occurs.
The description presents a bounded pre-entry evidence-analysis workflow, but the supplied commands expose a recurring monitoring service with subscription lifecycle and pricing controls. Those are material user-facing capabilities, not merely implementation details of analyzing product pages and reviews. ASIN and competitor resources are consistent with the description, and the snippet does not establish any prohibited forecasting behavior. The mismatch is the undeclared recurring, price-accepted monitoring functionality; the underlying API implementation is not shown.
Collecting product evidence supports the declared research purpose, but enabling recurring, potentially billable monitoring is a material operational capability not disclosed in that description. The chunk explicitly provides weekly scheduling and a manual mode described as stopping further charges. The underlying script is not supplied, so this assessment is limited to the behavior represented by these commands and comments.
The supplied commands concern recurring-monitoring administration and pricing rather than the declared product-page and review research outputs. These capabilities are not described or visibly connected to the declared research workflow. The monthly estimates appear to concern monitoring costs, not prohibited sales or profit forecasting; the mismatch is the undeclared watch-management functionality.
The competitor-comparison instructions describe binding a competitor as a step that automatically starts weekly collection, without an explicit recurring-cost approval gate at that step. An agent could mistake approval of a one-time comparison for authorization of ongoing competitor collection; other general consent rules reduce but do not eliminate this ambiguity.
The supplied commands concern watch administration and quotations, neither of which is disclosed in the narrowly scoped research description. The chunk does not demonstrate product-page comparison or review analysis. It also does not show enabling watches or forecasting sales, profits, or other expressly excluded business metrics; monthlyEstimate should not itself be interpreted as such a forecast.
The supplied command selects an alerts operation rather than an identified product-page or review-research operation. Alert functionality is not declared or shown to support the stated research workflow. This indicates a capability mismatch, although the missing script implementation limits certainty about its precise effects.
The default VOC workflow explicitly says to skip a prior quote and allows report generation and charging before confirmation. That contradicts this specialized skill's mandatory quote-first, explicit-consent rule and can consume account credits before the user has approved the price.
The operations section expressly calls this package unrestricted, while the final section restricts it to page_compare/entry and a fixed template. These conflicting instructions can cause an agent to select workflows outside the user's intended authorization boundary; the supplied material does not establish that the implementation rejects them.
run_analysis() converts a missing confirmation into authorization when the server returns sufficient and autoConfirm, allowing paid execution despite the documented explicit --confirm requirement. cmd_voc() similarly permits automatic collection and analysis; deepdive() can also reach this behavior through run_analysis(), undermining its claimed quote-only fallback. For an agent using commands to preview research costs, this can consume account credits without the expected approval.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
The surrounding instructions allow collection, generation, and charging under first-use or remaining-use exemptions that need not represent a user-selected spending limit. Treating those server rules as approval bypasses this skill's explicit quote-and-confirm requirement and exposes the account balance to unapproved spending.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
The autoConfirm field is treated as sufficient authority to execute and charge, even when eligibility comes from a service default rather than user approval. This is the same consent-boundary defect as the adjacent finding, not an additional independent spending mechanism.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。
The workflow directs immediate VOC execution without quoting and explicitly acknowledges that returned reports may already have incurred charges. Reporting the charge afterward does not satisfy the specialized skill's requirement for approval before spending.
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
**返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
（1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
**不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**
This section instructs generation whenever the server returns autoConfirm and says early paid generations can proceed without an amount ceiling. That substitutes service policy for informed user approval and conflicts directly with the fixed entry point's explicit-consent requirement.
- **价格一律以服务端本次报价为准**（`analysis/quote` 与 `collect` 报价返回的 `credits` /
`totalCredits`）。文档与示例里出现的任何单价、页数、合计都只是演示，后台可调，
**不要凭记忆或旧文档报数，也不要把示例价当成承诺价。**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点（取报价返回的 `credits` / `totalCredits`，
**不要自己算、不要写死单价**）、余额多少，然后等用户一个「好」。单价与页数由后台配置决定，