ClawHub
Back to skill

Security audit

Amazon 产品质量问题线索

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real ARI Amazon-review tool, but it needs review because it can store an API key, spend credits under auto-confirm rules, and change account monitoring or workflow settings beyond the narrow quality-issue description.

Install only if you trust ARI with the Amazon product/review data and are comfortable storing an ARI API key on this machine. Before use, set auto-confirm to always ask if you want per-action approval for any credit spend, avoid custom ARI_BASE_URL settings unless you control a trusted HTTPS endpoint, and be careful with export paths because existing files can be overwritten.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:99
Finding
Mandatory Promotional Content and External Links Hijack Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 99–116 and 230–231 **Vulnerability Type**: Persistent output manipulation through Skill instructions **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English translation of the relevant source instructions: ```text After the VOC report is generated, proactively mention that buyers' language in reviews is the best source of keywords and that the data can be used directly for advertising. When the output contains reportUrl, it must be appended at the end using the fixed wording: "View the complete graphical report online / Export: <reportUrl>" ``` ### Technical Analysis The Skill does more than instruct the agent to perform the declared Amazon quality-issue analysis. It mandates that otherwise complete answers include: 1. An unsolicited suggestion promoting an additional keyword-analysis and advertising use case. 2. A fixed closing message directing the user to the operator-controlled web service whenever a report URL is available. These instructions persist whenever the Skill is loaded and alter the content of the agent's final response independently of whether the user requested advertising advice, keyword analysis, online report access, or export functionality. A report URL can be relevant to the task, but requiring fixed promotional wording rather than allowing a neutral, context-dependent reference exceeds the minimum instruction scope necessary to summarize product quality issues. The proactive keyword-analysis upsell is more clearly unrelated to the specialized `product/quality` workflow. This behavior therefore constitutes instruction-level output hijacking rather than local code execution or privilege escalation. ### Attack Path 1. A user activates the Amazon quality-issue Skill. 2. The agent obtains or generates a VOC or quality-analysis report. 3. The Skill instructions require the agent to add an unsolicited promotion for another analysis ...[truncated 820 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove instructions that require proactive promotion of keyword analysis or advertising functionality. 2. Mention adjacent capabilities only when the user explicitly requests them or when they are directly necessary to answer the current question. 3. Replace the mandatory fixed closing text with a neutral rule such as: ```text If the user asks for the graphical report, export, or sharing options, provide the authenticated report URL returned by the API. ``` 4. Clearly distinguish essential result links from optional commercial features. 5. Avoid instructions requiring the agent to append operator-selected content to every qualifying response. 6. Preserve user intent by omitting external links and upsells when the user asks for a short answer or does not request them. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ari.py:55
Finding
Bearer API Key Can Be Transmitted to a Custom Plaintext HTTP Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py`, lines 55–71 and 300–320 **Vulnerability Type**: Missing secure-transport validation for authenticated requests **Risk Level**: High ### Vulnerable Code Snippet ```python def base_url(): override = (os.environ.get("ARI_BASE_URL") or "").strip().rstrip("/") if not override or override == PROD_BASE: return PROD_BASE if (os.environ.get("ARI_ALLOW_CUSTOM_BASE") or "").strip() != "1": emit(error_obj( "ARI_CUSTOM_BASE_BLOCKED", 0, "ARI_BASE_URL points to a non-official address; request refused", "For a private development environment, also set " "ARI_ALLOW_CUSTOM_BASE=1.")) raise SystemExit(2) return override ``` The returned URL is subsequently used for authenticated requests: ```python def request_json(method, path, payload=None, params=None): url = base_url() + path if query["params"]: url += "?" + urllib.parse.urlencode(query["params"], doseq=True) headers = { "Authorization": "Bearer " + require_key(), "Accept": "application/json", "User-Agent": user_agent(), } req = urllib.request.Request( url, data=data, headers=headers, method=method ) with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp: ... ``` The same custom base behavior also affects authenticated SSE and download requests. ### Technical Analysis The custom-base protection requires both `ARI_BASE_URL` and `ARI_ALLOW_CUSTOM_BASE=1`, which reduces the chance of an accidental single-variable redirect. However, `base_url()` performs no URL-scheme validation. Consequently, values such as the following are accepted: ```text ARI_BASE_URL=http://attacker.example ARI_ALLOW_CUSTOM_BASE=1 ``` Authenticated request functions then add the ARI API key to the HTTP `Authorization` header and transmit it using `urllib.request.urlopen`. With an `http://` destination, TL ...[truncated 2244 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Parse custom URLs with `urllib.parse.urlsplit` before accepting them. 2. Require the `https` scheme for every non-local authenticated endpoint: ```python parsed = urllib.parse.urlsplit(override) if parsed.scheme != "https": raise ValueError("Authenticated custom endpoints must use HTTPS") ``` 3. If plaintext HTTP is necessary for local development, permit it only for loopback hosts such as `127.0.0.1`, `::1`, or a strictly validated `localhost`. 4. Validate that the URL contains no embedded username or password and has a valid hostname. 5. Consider a separate explicit variable for insecure local testing, rather than reusing `ARI_ALLOW_CUSTOM_BASE`. 6. Construct the destination first, validate its scheme and host, and only then attach the `Authorization` header. 7. Add tests covering: - Rejection of arbitrary `http://` hosts. - Acceptance of approved HTTPS custom hosts. - Optional loopback-only development behavior. - Rejection of malformed URLs and credential-bearing authorities. 8. Document that custom endpoints receive the API key and should only be used when fully trusted. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ari.py:1444
Finding
Export Output Path Allows Destructive Overwrite of Arbitrary Writable Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py`, lines 1444–1477 and 1587–1604 **Vulnerability Type**: Unrestricted file write and unsafe overwrite **Risk Level**: Medium ### Vulnerable Code Snippet ```python def request_download(path, params, dest): query = { "method": "GET", "path": path, "params": { k: v for k, v in (params or {}).items() if v not in (None, "") }, "payload": None, } url = base_url() + path if query["params"]: url += "?" + urllib.parse.urlencode(query["params"], doseq=True) headers = { "Authorization": "Bearer " + require_key(), "User-Agent": user_agent(), } try: req = urllib.request.Request(url, headers=headers, method="GET") with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp: note_release(resp.headers) ctype = resp.headers.get("Content-Type", "") body = resp.read() if "application/json" in ctype: out = json.loads( body.decode("utf-8", errors="replace") ) if isinstance(out, dict): out["_query"] = query return out tail = body[-300:].decode("utf-8", errors="replace") if "# export error:" in tail: return error_obj( "ARI_EXPORT_ERROR", 200, tail.split("# export error:", 1)[1].strip(), "The export failed and was not written.", query, ) with open(dest, "wb") as fh: fh.write(body) ``` The destination is directly controlled by the `--out` argument: ```python def cmd_export(args): if args.report_id: fmt = args.format or "md" dest = args.out or ( "ari_report_%d.%s" % ( args.report_id, ...[truncated 3099 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Default exports to a dedicated directory owned by the current user. 2. Resolve the final path with `os.path.realpath` and verify that it remains inside the approved export directory. 3. Reject symbolic-link destinations using `os.path.islink` and secure descriptor-based checks. 4. Create new files exclusively by default: ```python fd = os.open( dest, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600, ) ``` 5. If overwriting is required, add an explicit `--force` option and require clear user authorization. 6. Download into a securely created temporary file in the destination directory, flush and synchronize it, and then perform an atomic rename. 7. Recheck the destination immediately before replacement to reduce time-of-check/time-of-use race conditions. 8. Apply restrictive file permissions where exported data can contain customer reviews, reports, or account information. 9. Validate or normalize extensions according to the selected export format. 10. Add tests for existing files, symbolic links, path traversal, absolute paths, and destinations outside the approved export directory. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (31)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            raw = resp.read().decode("utf-8")
            out = json.loads(raw) if raw else {"success": True, "data": None}
Confidence
94% confidence
Finding
Authenticated requests are sent to base_url(), which can be overridden via environment variables. Although the code adds a safeguard requiring ARI_ALLOW_CUSTOM_BASE=1 for non-default endpoints, a compromised shell/session or wrapper process that can set both variables can redirect Bearer-keyed traffic to an attacker-controlled host and exfiltrate the API key.

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(
            url, data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            content_type = resp.headers.get("Content-Type", "")
            if "text/event-stream" not in content_type:
Confidence
94% confidence
Finding
The SSE analysis path also uses the environment-overridable base_url() while attaching the Authorization Bearer token. This means long-lived streaming analysis requests can be redirected to an attacker-controlled endpoint if the process environment is tampered with, exposing credentials and request contents.

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()
Confidence
95% confidence
Finding
The download/export path sends authenticated requests using a base URL derived from environment variables. If an attacker can influence both ARI_BASE_URL and ARI_ALLOW_CUSTOM_BASE in the execution environment, they can cause the CLI to transmit the live API key to an arbitrary host during export operations.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs use of shell, network access, environment variables, and local file writes to perform setup, configure API keys, and run CLI workflows, but no explicit permissions are declared. That creates a transparency and least-privilege problem: an agent may gain broader capabilities than users expect, including storing secrets locally and making external requests. In a skill that handles billing-related actions and account state, undeclared capabilities materially increase risk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose says the skill is only for summarizing Amazon quality issues, but the content defines much broader behavior: API key onboarding, billing/credit management, auto-confirm threshold changes, paid analysis modes, competitor/watch management, report exports, and operations workflows. This mismatch can mislead users and security controls about the true operational and financial scope, increasing the chance of unauthorized data access, monitoring changes, or charged actions.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill is described as a narrow quality-issue clue extractor, but the implementation exposes broad product operations, monitoring, benchmarking, export, watch management, workflow execution, and AI-assisted handling features. This scope mismatch increases the chance that an agent or user invokes high-impact account mutations or paid actions they would not reasonably expect from the advertised capability.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The product-operations workflow provides operational decision-support capabilities well beyond quality-issue detection, including workflow execution and status tracking. In a skill advertised for issue detection only, this creates a deceptive interface boundary and can lead agents to trigger business actions or consume credits under false assumptions about scope.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Generating AI replies or handling advice for individual negative reviews is outside the stated mission of quality-issue clue extraction. This broadens the skill into customer-response automation, which may create reputational, compliance, or spending risks if an agent invokes it assuming the skill is read-only analytical tooling.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The autoconfirm command mutates account behavior by changing whether future paid operations can proceed without confirmation. That is materially outside passive quality-issue detection and can weaken user control over spending, especially if an agent is granted this skill based on its narrower description.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The guide documents broad product-operations features such as operational audits, watch/monitoring, workbench, alerts, exports, and other workflows that materially exceed the manifest’s stated purpose of detecting product quality issues from low-star reviews. This scope mismatch is dangerous because an agent or user may invoke capabilities with different data access, billing, automation, or decision-making effects than expected, undermining least-privilege expectations and informed consent.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The documentation advertises competitor benchmarking, category ranking, radar, and leaderboard functions that go beyond quality-issue detection. Such hidden scope expansion can cause the skill to access or act on broader commercial intelligence workflows than the user or platform expects, increasing the chance of unauthorized use, excessive data processing, or misleading trust in a narrowly described tool.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The opening description markets the tool as a general Amazon review intelligence assistant for dissatisfaction analysis, purchase-motivation analysis, and copy optimization, which conflicts with the manifest’s explicit limitation to quality-issue clues only. This is risky because it encourages use for broader persuasive or market-analysis tasks outside the declared scope, making downstream tool behavior less predictable and weakening user understanding of what data and actions are appropriate.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
Confidence
93% confidence
Finding
This workflow authorizes the agent to proceed with billable report generation whenever the backend marks a request as auto-confirmed, even if the user did not explicitly approve that specific spend in the current interaction. That creates a real risk of unintended charges and autonomous execution of paid operations based on server-side policy rather than fresh user consent.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、
Confidence
92% confidence
Finding
The skill directs the agent to run default VOC analysis flows that may automatically collect data, wait for tasks, and generate paid reports, with confirmation only if the backend demands it. Because the backend may waive confirmation, the agent can trigger spend and external processing without an explicit user opt-in for that exact action.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
Confidence
94% confidence
Finding
The instructions explicitly tell the agent to execute generation immediately when a quote returns autoConfirm=true. That is dangerous because it normalizes autonomous spending and reduces the chance that users understand when charges or data collection will occur.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
Confidence
90% confidence
Finding
The same line couples natural-language interpretation ('以后别问了 / 50 以内直接做') with direct execution of persistent autoconfirm settings. Ambiguous phrasing could be over-interpreted, causing the agent to lower safeguards on future billable actions without sufficiently specific authorization.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
Confidence
90% confidence
Finding
The same line couples natural-language interpretation ('以后别问了 / 50 以内直接做') with direct execution of persistent autoconfirm settings. Ambiguous phrasing could be over-interpreted, causing the agent to lower safeguards on future billable actions without sufficiently specific authorization.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
Confidence
91% confidence
Finding
This command allows changing the account's auto-confirm threshold, which can enable future paid actions to proceed without an explicit per-action confirmation. In the context of a skill advertised as analytical and limited to quality-issue detection, exposing administrative spending-control changes is risky and can reduce user oversight.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
91% confidence
Finding
This logic parses user input to set auto-confirm behavior including disabling confirmations ('off') or resetting to defaults. While not malicious, it changes spending governance and is more powerful than expected for a quality-issue detector, creating risk of unintended autonomous purchases later.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
91% confidence
Finding
This logic parses user input to set auto-confirm behavior including disabling confirmations ('off') or resetting to defaults. While not malicious, it changes spending governance and is more powerful than expected for a quality-issue detector, creating risk of unintended autonomous purchases later.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
91% confidence
Finding
This logic parses user input to set auto-confirm behavior including disabling confirmations ('off') or resetting to defaults. While not malicious, it changes spending governance and is more powerful than expected for a quality-issue detector, creating risk of unintended autonomous purchases later.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
The PUT to /api/v1/user/autoconfirm persists a new confirmation policy on the account. This can materially change how future paid operations are authorized, enabling downstream autonomous charges or reducing user awareness of billable actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
The PUT to /api/v1/user/autoconfirm persists a new confirmation policy on the account. This can materially change how future paid operations are authorized, enabling downstream autonomous charges or reducing user awareness of billable actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
The PUT to /api/v1/user/autoconfirm persists a new confirmation policy on the account. This can materially change how future paid operations are authorized, enabling downstream autonomous charges or reducing user awareness of billable actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
if not ok(quote):
        return quote
    q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
Confidence
96% confidence
Finding
The code explicitly auto-confirms paid analysis when the server indicates autoConfirm and sufficient balance, even if the caller did not pass --confirm. This can cause billable operations to execute without a fresh per-action user confirmation, which is risky in agent contexts where the skill may be invoked indirectly.

Static analysis

No suspicious patterns detected.