Security audit
Security checks for vulnerabilities and agentic risk
This skill can consume account credits during supposedly free previews and execute previously unanswered requests without fresh approval.
Before analysis, set and verify “ask before every charge.” Use the dedicated quote command for price checks; omitting --confirm does not reliably make deepdive free. Approve recurring costs separately and select manual collection for one-time work. The billing inconsistency warrants review, although no evidence of malicious intent was found.
scripts/ari.pyQuote-only deepdive calls can unexpectedly execute paid analysis
Account credits can be consumed while the caller expects a free preview. The missing-subscription branch can also state that analysis was downgraded and no credits were charged even though the helper executed it.
scripts/ari.pyRecurring paid collection can be enabled without an executable consent gate
A direct helper invocation can activate repeated credit deductions before the user has accepted the recurring cost. In the schedule path, pricing is fetched and the cost note is constructed only after the state-changing request succeeds.
The mismatch becomes security-relevant where a review-analysis request can trigger credit-consuming execution under uncapped introductory defaults, rather than explicit user-established spending authority. The broader functionality is not inherently unsafe, and monitoring has substantial consent safeguards, but those safeguards do not resolve the initial-analysis billing gap.
声明描述的是评论痛点分析，而代码片段展示的是定期监控任务的生命周期管理，未展示评论提炼、情绪与频次排序或原文佐证。持续监控和价格确认属于未声明的独立能力，并非完成一次痛点分析所必需的普通实现细节。该片段仅展示 CLI 调用，不能据此断言监控任务已实际创建或已发生收费。
The comparison workflow introduces competitor binding that automatically enables weekly collection, without specifying a competitor-specific recurring-cost quote and approval step. General recurring-charge authorization rules mitigate this, but the local workflow can still encourage treating approval for a one-time comparison as approval for persistent collection.
Recurring monitoring and its lifecycle and pricing controls are materially broader than the declared review-based pain-point analysis. Although monitoring results could support that analysis, creating ongoing watches and accepting refresh pricing are separate capabilities not disclosed in the description. The supplied chunk contains CLI examples rather than implementation, so it establishes the exposed command workflow but does not verify execution or actual charges.
The declared purpose is review-based pain-point analysis, but the supplied chunk exposes a persistent monitoring workflow with scheduling, lifecycle management, and pricing acceptance. These are substantial additional capabilities rather than merely implementation details of analyzing reviews. Digests could support customer insight analysis, but the broader watch-management behavior is not disclosed. The underlying implementation is not supplied, so this assessment is limited to the operations represented by the commands.
Review collection can support pain-point analysis, but configuring persistent, potentially billable monitoring is a distinct operational capability not disclosed in the description. The supplied commands manage collection schedules rather than perform the declared review analysis. The underlying scheduler implementation is not shown, so the assessment is limited to the exposed commands and their stated effects.
The visible commands concern watch management and pricing rather than extracting or ranking review-based pain points. These capabilities are not declared or shown to be supporting steps for the stated analysis workflow. The underlying ari.py implementation is not supplied, so no additional behavior can be established.
The supplied commands concern watch-service pricing and watch listings rather than review-based pain-point extraction. These capabilities are not declared or shown to support the stated analysis workflow. The underlying CLI implementation is not supplied, so the chunk does not establish that it creates watches, changes settings, or incurs charges.
The supplied commands expose watch-monitoring functionality that is not declared in the review pain-point analysis description. The chunk does not show review analysis, pain-point ranking, issue classification, or supporting review citations. Although monitoring data could potentially support such analysis, no connection is established in the supplied content. The CLI implementation is not provided, so further behavior cannot be verified.
The supplied command requests a Kitchen-category leaderboard. Ranking by aggregate negative-review rate is materially different from identifying specific complaints, assessing emotional intensity, distinguishing messaging issues from product defects, and citing original reviews. Although a leaderboard could support a broader research workflow, this chunk provides no evidence of the declared pain-point analysis. The underlying CLI implementation is not supplied, so additional behavior cannot be verified.
The visible invocation requests competitor comparison rather than the declared review-based pain-point analysis. Although comparison could potentially support customer-needs research, the supplied command does not establish that connection or request the advertised pain-point outputs. The underlying script is not provided, so this assessment is limited to the explicit command behavior.
The visible command selects --type compare and supplies --competitor, indicating a comparison workflow rather than the declared pain-point extraction workflow. ARI usage and Amazon product identifiers are consistent supporting details, but the explicitly selected analysis purpose differs. The underlying script is not supplied, so its exact outputs and any additional behavior cannot be verified.
The supplied command targets alerts, rather than an explicitly review-analysis or pain-point-extraction operation. Alert functionality is not declared, and the snippet provides no evidence that it supports the stated analysis workflow. This indicates a mismatch, although the missing script implementation limits certainty about the command's exact behavior.
The command explicitly selects '--workflow audit --focus full', which indicates a broader audit operation than the declared review-analysis purpose. The Amazon ASIN and ARI CLI are consistent with the stated context, but the full-audit scope is not disclosed. Because the implementation of scripts/ari.py is not supplied, the audit's exact actions and side effects cannot be established.
cmd_autoconfirm can persistently change account-level spending safeguards through a PUT request without a separate confirmation step. In a pain-point analysis skill, an agent invocation can therefore affect future spending beyond the immediate analysis; actual exposure depends on the unseen allowedCommands configuration.
run_analysis converts an absent confirmation into authorization to spend when the server returns a truthy autoConfirm value, contradicting the explicit --confirm contract. cmd_voc similarly extends an analysis quote's autoConfirm decision to collection and analysis, potentially consuming credits without approval of the combined cost; deepdive also inherits this behavior.
In context, this documents reliance on a server-provided autoConfirm flag for automatic credit spending, including the amount-unbounded introductory policy described in version 1.5.0. A server eligibility decision is not necessarily user authorization to spend, creating a risk of unexpected credit depletion; the changelog alone does not establish whether the implementation has additional consent controls.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented policy executes collection and report generation without a price-confirmation step, and explicitly applies no amount ceiling to the first N paid generations. Requesting product analysis does not necessarily authorize an unspecified charge; respecting explicit confirmation preferences and checking the balance reduce, but do not eliminate, unexpected spending risk.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This overlaps the same amount-unbounded automatic-spending policy flagged at line 32, rather than representing a separate vulnerability. Using a structured boolean instead of interpreting explanatory prose is appropriate, but it does not establish that the user authorized the resulting charge.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This is a duplicate detection of the same policy: server authorization can trigger paid work without an amount ceiling during introductory usage. The risk is unexpected consumption of account credits, not the mere presence of an autoConfirm field or evidence of malicious intent.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This extends the same automatic-spending policy to multiple analysis types, increasing the operations that may consume credits without transaction-specific approval. Returning charges afterward provides transparency but cannot substitute for prior authorization; insufficient-balance rejection limits losses to available credits as documented.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
p = sub.add_parser("version", parents=[common], help="显示 Skill 版本与渠道（无需 Key）")
p.set_defaults(fn=cmd_version)
Without declared permissions the skill's intent is opaque and cannot be validated.