Security audit
Security checks for vulnerabilities and agentic risk
The skill’s review-reading features, local authorization storage, and optional marking of alerts as read match its disclosed purpose and user controls.
Authorize your intended ARI account at ari.funewa.com and keep the locally stored API key private. Use --mark-read only when you want every unread account alert marked read; this does not resolve the underlying review issues.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'file_write' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
"user": data_of(me),
"balance": data_of(balance),
}, "links": links()}, args.compact)
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
if args.purchased:
params["purchased"] = "1"
emit(request_json("GET", "/api/v1/reviews", params=params), args.compact)
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
allowed = {item.strip() for item in commands
if isinstance(item, str) and item.strip()}
return allowed or None
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
p.add_argument("--page", type=int, default=1)
p.add_argument("--topic", default="", help="按话题 key 筛（1.4.7，key 来自 topics 命令）")
p.set_defaults(fn=cmd_reviews)
The docstring at L662 explicitly says this handler only reads alerts, but L663–L665 issue POST /api/v1/alerts/read when --mark-read is supplied. This state-changing operation is allowed by the manifest when explicitly requested, but directly contradicts the handler's read-only documentation.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
所以校验不能写死 B 前缀。顺手把值归一成大写，后续命令不必再 upper()。
"""
for attr in ("asin", "competitor"):
value = getattr(args, attr, None)
if value in (None, ""):
continue
normalized = str(value).strip().upper()