Amazon 退货风险线索

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:37 AM UTC
• Version: 1.4.8

Overview

The skill is mostly a legitimate Amazon review analysis tool, but it can trigger paid ARI actions and persistent account settings with broader authority than the narrow return-risk description suggests.

Review this skill carefully before installing. It needs an ARI API key and can access your ARI account data, save credentials locally, generate paid reports, change auto-confirm spending behavior, export files, and configure ongoing monitoring or competitor collection. Use it only if you trust the ARI service and prefer to disable auto-confirm if you want every paid action approved first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (38)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill directs the agent to use shell, network, environment-variable, and local file-write capabilities, including saving API keys locally and exporting reports/files, but it declares no permissions or equivalent trust boundary to the user. This creates a real security issue because the agent can perform sensitive side effects and handle secrets without an explicit, least-privilege permission model or clear user-visible capability declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The published description frames the skill as a narrow return-risk detector, but the instructions authorize many broader and state-changing operations: account checks, key setup/storage, paid report generation, exports, scheduling, watch management, competitor management, and settings changes such as autoconfirm. This mismatch is dangerous because users may invoke the skill expecting passive review analysis while the agent can trigger billing, modify monitoring state, or persist credentials beyond that stated scope.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The skill description promises a narrow, evidence-only return-risk detector, but this code exposes broad product-operations workflows that can run paid, server-side operational analyses outside that scope. In an agent setting, this scope expansion increases the chance of unintended account actions, charges, and access to data/functions the user did not mean to delegate to this skill.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: Competitor, radar, and leaderboard features materially exceed the stated purpose of identifying return-risk clues from reviews and product details. While not inherently unsafe code execution, this mismatch broadens data access and paid functionality, making accidental misuse by an agent more likely.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill can persist API keys locally and modify account state through setup/configure flows, despite being described as an analysis-only tool. In a delegated-agent context, hidden state changes and credential persistence are more sensitive than simple read-only evidence analysis and should be explicitly scoped and disclosed.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The generic operations-run capability allows execution of server-side workflows based on workflow/focus values, which is unjustified for a return-risk evidence detector. Even with confirmation checks, embedding a generic execution primitive in a narrowly scoped skill creates excessive authority and increases the blast radius of agent misuse or prompt confusion.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The skill metadata promises a narrowly scoped capability focused on Amazon review evidence and explicitly says it is not for inventory, refunds, or execution, but the documentation exposes broader product-watch, operations, benchmarking, competitor binding, export, and alert workflows. This scope mismatch is dangerous because users and host platforms may grant trust, permissions, or approvals based on the declared narrow purpose while the skill can drive materially broader business actions and data access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 97% confidence
• Finding: The workflow explicitly allows paid operations to execute automatically when the backend marks them as auto-confirmed, with instructions not to ask the user again before generation. This is dangerous because the skill can incur charges and perform external actions without contemporaneous user approval, reducing informed consent and making accidental spend or abuse easier.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 96% confidence
• Finding: The documented default action is to run `voc <ASIN> --site <站点>`, and the surrounding text states that this may directly generate a paid report depending on server-side confirmation rules. That makes the skill capable of initiating chargeable external work from a natural-language request without a strict local consent gate, which is a real autonomy/billing risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 97% confidence
• Finding: The skill states that if quote results indicate `autoConfirm: true`, it should directly generate and only explain the charge afterward. Post-hoc notice is not equivalent to authorization, and in a tool-using agent this can lead to unapproved spending or abuse through prompting users into seemingly harmless analysis requests.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 95% confidence
• Finding: This finding refers to the same `autoconfirm` behavior at the same location: the agent is instructed to update persistent spending controls based on brief conversational commands. Because this alters future authorization posture, it increases the risk of unintended or socially engineered purchases in later interactions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 95% confidence
• Finding: This finding refers to the same `autoconfirm` behavior at the same location: the agent is instructed to update persistent spending controls based on brief conversational commands. Because this alters future authorization posture, it increases the risk of unintended or socially engineered purchases in later interactions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**
- 报告讲完只推一个下一步，附接口返回的成本，不写死月费用。用户同意再 `schedule --set weekly`。
- 不解释命令名，不列功能清单。用户问「还能做什么」时按他的产品状态给一条建议，不超过三句。

• Confidence: 90% confidence
• Finding: After a report, the skill tells the agent to push a next step with cost and, upon simple user agreement, execute `schedule --set weekly`, which enables an ongoing monitored collection workflow. Because this is a persistent, potentially billable configuration change, the skill context makes it more dangerous than a one-off analysis action.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch delete` | product-operations/watches/{id}（DELETE） | 否；不删除商品资料、评论或历史报告 |
| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |

• Confidence: 90% confidence
• Finding: The documentation explicitly allows `analyze` to execute and incur charges when server-side `autoConfirm` rules are met, meaning the agent may trigger paid analysis without an explicit per-action user confirmation. In an agent setting, this weakens user consent boundaries and can lead to unauthorized spending or unintended external processing of product/review data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same `autoconfirm` capability, which can reduce or remove interactive consent before a paid action. In practice, that creates a risk of unauthorized charges or unexpected remote processing initiated by the agent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same `autoconfirm` capability, which can reduce or remove interactive consent before a paid action. In practice, that creates a risk of unauthorized charges or unexpected remote processing initiated by the agent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 94% confidence
• Finding: This section states that VOC generation may proceed automatically under service-side no-confirmation rules and will then perform collection, waiting, analysis, and archiving. Because these are multi-step external actions with possible charges, allowing them to run automatically is dangerous in an agent context where the user may have intended only to quote or inspect options.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 93% confidence
• Finding: The quote response includes `autoConfirm` metadata that signals whether the service will allow direct execution without confirmation. If the agent honors this field, it can convert a pricing check into a live paid action path, undermining user consent and enabling unintended spending.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 93% confidence
• Finding: This duplicate instance identifies the same risk: a paid analysis can proceed automatically based on server-side rules rather than a deliberate agent-side approval. That creates exposure to surprise charges and unintended submission of product/review data to external analysis endpoints.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 93% confidence
• Finding: This duplicate instance identifies the same risk: a paid analysis can proceed automatically based on server-side rules rather than a deliberate agent-side approval. That creates exposure to surprise charges and unintended submission of product/review data to external analysis endpoints.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 91% confidence
• Finding: The documented behavior returns `autoConfirmed: true`, indicating execution may already have happened without an explicit user confirmation step in the current interaction. This is risky because the irreversible external side effect has already occurred by the time the result is surfaced.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 91% confidence
• Finding: This additional duplicate again highlights the same autonomous execution risk tied to auto-confirmed analysis. The file otherwise contains some good safety language around custom base URL restrictions and not running remote code, but those controls do not mitigate unauthorized billable actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 91% confidence
• Finding: This additional duplicate again highlights the same autonomous execution risk tied to auto-confirmed analysis. The file otherwise contains some good safety language around custom base URL restrictions and not running remote code, but those controls do not mitigate unauthorized billable actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 91% confidence
• Finding: This additional duplicate again highlights the same autonomous execution risk tied to auto-confirmed analysis. The file otherwise contains some good safety language around custom base URL restrictions and not running remote code, but those controls do not mitigate unauthorized billable actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:

• Confidence: 86% confidence
• Finding: This command allows the agent/client to configure automatic approval thresholds for future paid operations, changing account behavior from confirm-first to charge-without-prompt under a limit. In the context of a narrowly scoped analytical skill, enabling or modifying autonomous spending policy increases the risk of unintended charges and weakens user control.

Static analysis

No suspicious patterns detected.