Security audit
Security checks for vulnerabilities and agentic risk
This requirements tool exposes broader account controls and can spend credits without consistently obtaining your approval.
Prefer a corrected package that enforces its requirements-only scope. If proceeding, set ARI to ask before every charge, explicitly request manual collection, and inspect existing product and competitor schedules because manual collection preserves previously configured plans. An unanswered quote should never authorize later spending.
scripts/ari.pyRecurring paid collection can be enabled without an executable confirmation gate
An Agent can activate recurring daily or weekly collection before obtaining approval for its recurring cost, causing subsequent collection charges until the schedule is changed back to manual.
The requirements-only skill includes operational instructions for paid execution, recurring collection, and account configuration. Its final fixed-entry restriction mitigates this, but retaining contradictory executable workflows creates a credible path to out-of-scope actions and unexpected credit consumption.
Creating recurring watches and accepting refresh prices contradict the requirements-only boundary. Explicit user agreement is required by the watch workflow, so this is a scope-isolation weakness rather than evidence of an unconditional billing bypass.
Persistent monitoring mutations are an out-of-scope capability within a requirements-only skill and conflict with its final restriction. The mandatory quote and explicit acceptance requirements mitigate unauthorized billing; historical-series and digest reads are not independently dangerous.
Instructions for creating and resuming recurring watches conflict with the fixed requirements-only entry point. Explicit pricing and user-consent requirements substantially reduce the financial risk, but the contradictory operational scope remains a boundary weakness.
Recurring collection configuration extends beyond requirements organization and can create continuing financial obligations. Instructions to obtain consent and use manual collection when recurring authorization is absent reduce the risk, but the weekly default and conflicting scope make accidental activation plausible.
The competitor-binding instructions say added competitors enter automatic weekly collection, but that step lacks an equally explicit, local recurring-cost approval gate. Approval for a one-time comparison should not be treated as approval for continuing competitor collection.
声明的范围是产品需求与验收问题整理，而所示命令用于报价监控及监控项查询，未体现评论分析或需求整理行为，属于未声明的功能。代码片段未提供 CLI 实现，因此不能确认其具体数据访问、是否实际创建定时任务或是否执行采购；但可见命令及注释已足以表明功能范围不一致。
The supplied commands operate on an existing watch ID to obtain monitoring summaries, events, and historical series. They do not show review analysis or the production of product requirements and acceptance questions, and the declared description does not establish watch monitoring as a supporting capability. This assessment is limited to the visible commands; there is no evidence here of procurement execution, development scheduling commitments, or sales forecasting.
The declared purpose is requirements synthesis, whereas the supplied commands concern watch/monitoring configuration visibility and pricing. Those capabilities are not described or shown to support requirements synthesis in this chunk. The snippet does not establish that it creates watches, executes purchases, or performs sales forecasting.
The only visible operation invokes alerts, rather than an operation for organizing review evidence into requirements or acceptance questions. This indicates an undeclared alert-related capability. The finding is limited to the invoked subcommand; the snippet does not establish whether alerts are retrieved, created, or modified.
The generic workflow directs immediate VOC execution without a preliminary quote, while the specialized entry requires quotation and explicit confirmation before charging. Following the generic path can therefore consume credits without satisfying the specialized authorization gate.
The skill explicitly turns an unanswered quotation into a later attempt to generate a report, potentially charging credits when auto-confirm applies. Silence and a stale idle-product record do not establish current authorization for a paid task.
run_analysis changes confirm from false to true based on the remote quote's autoConfirm field, then invokes a credit-consuming analysis endpoint. This contradicts the explicit --confirm guarantee and can make analyze or apparently quote-only deepdive calls spend credits without per-operation approval; the code does not establish that the server policy represents informed user consent.
This entry endorses using the server's autoConfirm flag to waive confirmation; the surrounding release notes describe automatic paid operations without establishing prior user opt-in. A service-controlled default is not equivalent to user authorization to spend credits, particularly for a skill advertised as requirements organization. This documents a consent-boundary weakness, although the implementation is not available for verification.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented workflow automatically collects data, generates a report, and deducts credits after a user supplies an ASIN, without first presenting the charge for confirmation. The server policy allows the first N paid generations without an amount cap; displaying charges afterward and checking sufficient balance do not establish informed spending consent. Gift credits and explicit user preference overrides reduce exposure but do not eliminate the default authorization gap.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
The surrounding policy makes a server-returned boolean sufficient to bypass confirmation for paid work, with no documented requirement that the default originate from user consent. Respecting a user-defined threshold or an explicit 'always ask' preference is protective, but users who have not configured either may still lose credits unexpectedly. This is another occurrence of the same spending-authorization issue, not a separate exploit.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This finding duplicates the same policy passage: paid execution may proceed based on autoConfirm rather than demonstrated user authorization. Using a structured boolean instead of interpreting explanatory text is sound parsing practice, but it does not resolve the underlying consent gap. The documented user overrides and balance checks mitigate, rather than eliminate, unexpected credit consumption.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This entry extends automatic paid execution to multiple analysis types whenever autoConfirm is true, broadening the same consent-boundary weakness beyond VOC generation. Returning charges after generation provides transparency but cannot substitute for prior authorization. Actual exposure depends on whether these commands are present in this specialized package, which the changelog alone does not establish.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)