product-page-audit

• Outcome: Review
• Latest audit: Sep 17, 2026 · 7:14 AM UTC
• Version: 1.4.13

Overview

This is mostly a disclosed ARI product-page audit skill, but its CLI can run broader paid product-operation workflows than the single-page audit description promises.

Review this before installing if you only want a narrow page-audit skill. The ARI key storage and official network access are disclosed, but the bundled CLI should be constrained so operations cannot override workflow/focus or include a competitor ASIN unless those broader paid workflows are intentionally documented and desired.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description promises a narrowly scoped single-product page audit skill. The code does include relevant audit-related infrastructure, but it also exposes materially broader capabilities: collecting reviews for a product, checking balances and billing-related quotes, and especially a generic 'operations' subsystem that supports workflow/focus-driven product operations, profile retrieval, quote/run/status, and even a competitor ASIN parameter. That directly conflicts with the statement that it is not for dual ASIN comparison and not for broader operational use. While some narrowing may occur at packaging time via allowedCommands, the supplied code chunk itself clearly contains undeclared capabilities beyond a simple single-page audit.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill reads environment variables, performs network access, and writes local files, yet the described skill scope is a narrowly defined single-product page audit. Undeclared sensitive capabilities increase the chance that an agent or user invokes the skill without understanding it can access secrets, persist credentials, and communicate externally, creating a permission/scope mismatch.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill reads environment variables, performs network access, and writes local files, yet the described skill scope is a narrowly defined single-product page audit. Undeclared sensitive capabilities increase the chance that an agent or user invokes the skill without understanding it can access secrets, persist credentials, and communicate externally, creating a permission/scope mismatch.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill reads environment variables, performs network access, and writes local files, yet the described skill scope is a narrowly defined single-product page audit. Undeclared sensitive capabilities increase the chance that an agent or user invokes the skill without understanding it can access secrets, persist credentials, and communicate externally, creating a permission/scope mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code accepts a competitor ASIN even though the skill description says it is not for dual-ASIN comparison. This broadens the tool from single-item review into comparative analysis, enabling off-scope data processing and potentially different decision-making workflows than the user authorized.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The metadata says the skill is only for single-product page audit and explicitly excludes broader uses, but the code includes product-operations capabilities such as quote/run/status workflows. This mismatch is dangerous because it exposes materially broader business actions and analysis paths than the user was told to expect, undermining informed consent and least privilege.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all user-facing natural-language content in Chinese only. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.

md

- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README presents all invocation instructions and example user prompts only in Chinese, including the recommended first-use command and everyday usage guidance. This creates a language/locale constraint without any indication that users may choose another language, which matches the policy-violation category for forced language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The display name, description, and default prompt are all written in Chinese, which indicates a fixed language choice in the skill's user-facing behavior. The file does not provide any opt-in, alternative locale, or justification that the skill is intentionally restricted to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code hardcodes Chinese locale paths like /zh/... for account, billing, reports, and dashboard links, and the CLI also uses Chinese user-facing text throughout. Because the file provides no user opt-in or configurable locale selection, it appears to impose a specific language/locale policy on all users.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/ari.py (reported line 741)May include surrounding context.

python

emit({"success": True, "data": collection_quote(plan), "links": links()}, args.compact)
        return
    emit(execute_collection(plan, args.wait, args.interval, args.timeout), args.compact)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/ari.py (reported line 771)May include surrounding context.

python

def cmd_status(args):
    emit(request_json("GET", "/api/v1/collection/status/" + urllib.parse.quote(args.task)), args.compact)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill advertises page auditing only and states it is not for automatic page modification, yet it exposes operational analysis/run flows that go beyond a simple audit. Even if the code does not directly edit Amazon pages, 'run' functionality can drive higher-impact operational decisions and paid actions that exceed the disclosed purpose.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/ari.py (reported line 933)May include surrounding context.

python

def cmd_operation_status(args):
    request_id = urllib.parse.quote(args.request_id.strip(), safe="")
    emit(request_json("GET", "/api/v1/product-operations/runs/" + request_id), args.compact)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/ari.py (reported line 975)May include surrounding context.

python

所以校验不能写死 B 前缀。顺手把值归一成大写，后续命令不必再 upper()。
    """
    for attr in ("asin", "competitor"):
        value = getattr(args, attr, None)
        if value in (None, ""):
            continue
        normalized = str(value).strip().upper()