Security audit
Security checks for vulnerabilities and agentic risk
This packaging-analysis skill exposes broader paid services and can initiate paid analysis through a documented preview path.
Prefer a corrected packaging-only release that enforces its command and workflow limits and keeps previews free. Before use, select 'ask before every charge' in ARI and check existing collection schedules. Use the separate quote command for estimates; do not assume deepdive is free. Recurring monitoring requires separate approval of its frequency and cost.
scripts/ari.pyDeepdive's quote-only path can automatically initiate paid analysis
A preview can consume account credits and create an archived report without the command-specific authorization promised to the user. When the primary subscription is missing, the output can additionally claim that analysis was downgraded to a quote despite the paid request having been issued.
The packaging-only declaration and final fixed-workflow section conflict with extensive instructions for general operations, paid VOC generation, and persistent monitoring. These competing execution paths can cause an agent to exceed the selected skill's scope and bypass its explicit quote-and-confirm requirement; however, the supplied Markdown does not verify every code capability alleged by the scanner.
This is another instance of the same recurring-watch scope violation, rather than an independent exploit. Explicit per-refresh approval protects against silent watch activation, but executable monitoring instructions still contradict the packaging-only entry point.
This duplicates the monitoring scope-boundary issue: a packaging-only skill contains an executable path to recurring product and competitor monitoring. The requirement for explicit recurring-price consent reduces financial risk, so this is not evidence that watch creation automatically bypasses authorization.
The competitor-binding instructions state that adding a competitor starts weekly automatic collection, but do not clearly require separate approval of that recurring consequence at the binding step. Consent to a one-time comparison is not authorization for ongoing collection, and the general scheduling safeguards are not explicitly connected to this command.
The file provides actionable instructions for persistent price, ranking, and competitor watches despite declaring a packaging-only execution boundary. Explicit pricing confirmation and ownership checks substantially mitigate unauthorized charges, but do not resolve the contradictory scope or prevent invocation of an unrelated persistent service.
所展示的命令面向 watch 功能的报价和列表操作，而非评论证据提取或包装问题分析。声明未说明这些监控与费用管理能力，也没有上下文证明其为包装分析所需的支持性实现。由于未提供 ari.py 实现，无法确认实际网络访问、定时执行或状态变更；本判断仅依据已展示的命令及注释。
The skill includes recurring collection configuration even though its fixed entry point is packaging analysis. Instructions to use manual collection without recurring authorization and obtain agreement before enabling weekly collection mitigate unauthorized billing, but the unrelated mutation path remains available within the specialized skill.
The supplied command requests a Kitchen-category leaderboard based on overall negative-review rate. It contains no packaging-specific filtering, evidence extraction, or improvement-task generation, so its visible purpose differs from the declared packaging-only scope. The implementation of scripts/ari.py is not supplied; the confirmation flag alone does not establish that any claims, ordering, inventory changes, or other writes occur.
The supplied commands expose watch-service quoting and listing capabilities rather than extracting packaging issues or evidence from reviews. The chunk does not establish that these operations support the declared packaging-analysis workflow. It also provides no evidence of logistics claims, supplier ordering, or inventory execution.
The visible command requests an operations quote rather than explicitly requesting packaging-feedback analysis. This introduces an undeclared capability. The underlying script is not supplied, so the snippet does not establish that it places orders, executes inventory changes, or submits logistics claims.
The declared scope is packaging-only review analysis, but the supplied command explicitly requests a competitor comparison rather than packaging-focused analysis. No packaging-specific scope or evidence-extraction operation is visible. The underlying script is not supplied, so the comparison's exact contents remain uncertain; there is no visible evidence of logistics claims, supplier ordering, or inventory execution.
An unanswered quote is explicitly used as a reason to generate the report in a later conversation. Silence and an idle product record do not establish current execution intent or spending authorization, even if the service's automatic-confirmation policy allows the charge.
run_analysis replaces a missing local confirmation with the server-provided autoConfirm value and then invokes a paid analysis endpoint. This violates the documented explicit --confirm boundary and can make analyze or deepdive consume credits when the caller expects only a quote; reachability in this specialized package depends on its unavailable command allowlist.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch digest` | product-operations/watch-digest（GET） | 否；`creditsUsed` = 窗口内已确认的刷新扣点 |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
else:
out = request_json("GET", "/api/v1/user/autoconfirm")
if ok(out) and isinstance(data_of(out), dict):
d = data_of(out)
d["note"] = AUTOCONFIRM_MODE_NOTE.get(d.get("mode"), AUTOCONFIRM_MODE_NOTE["ask"]).format(
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
p = sub.add_parser("version", parents=[common], help="显示 Skill 版本与渠道（无需 Key）")
p.set_defaults(fn=cmd_version)