Amazon 评论证据文案规划

• Outcome: Review
• Latest audit: Sep 13, 2026 · 7:04 PM UTC
• Version: 1.4.9

Overview

This skill is a disclosed ARI review-analysis client, but it can spend credits and change ongoing monitoring or account settings beyond a simple copywriting helper.

Review this before installing if you only want a read-only copywriting helper. Install only if you trust the ARI service and want an agent to manage paid Amazon review analysis, exports, monitoring, competitor tracking, and account confirmation settings. Consider setting the account to ask before every paid action and use explicit wording such as 'only quote, do not execute' when you do not want credits spent or monitoring changed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (70)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is narrow copy-planning from Amazon reviews, but the documented behavior includes paid task execution, account and API key setup, billing/auto-confirm changes, monitoring management, exports to local files, and other account-affecting workflows. This mismatch can cause users or orchestrators to invoke the skill under the assumption of read-only analysis while it actually performs state-changing or billable actions.

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can change persistent monitoring schedules and competitor configuration, which are state-changing account operations unrelated to passive review-based copy planning. In an agent setting, these actions can silently alter a user's ongoing data collection, costs, and competitive tracking posture, creating lasting side effects beyond the immediate session.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to be only for evidence-driven Amazon listing copy planning, but the CLI exposes broad product-operations, watch, workbench, advice, exports, and operational run/status capabilities far beyond that scope. This scope expansion increases the blast radius: an agent granted this skill could trigger unrelated account actions, operational workflows, and paid tasks that users would not reasonably expect from a copywriting-planning tool.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README presents all user-facing invocation and usage instructions exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or an explicit justified locale constraint is a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises broad operational capabilities including shell, network, environment access, and local file writes, but does not declare any tool scope or allowlist. That leaves the agent with more authority than users would reasonably infer, increasing the risk of unintended command execution, secret exposure, local persistence, or filesystem modification if the skill is invoked in the wrong context or later extended unsafely.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The natural-language entry examples are broad enough to match ordinary product-analysis requests, but the skill does not sharply delimit when this specialized skill should activate. That makes accidental invocation more likely, which is especially risky here because the skill can perform paid collection and other external actions beyond simple summarization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 95% confidence
• Finding: This workflow explicitly allows the service to auto-confirm and immediately generate a paid report before the user gives a fresh confirmation in the current interaction. In an agent setting, that weakens user-consent guarantees and can turn a natural-language analysis request into a billable action without an unmistakable approval step at execution time.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 90% confidence
• Finding: The documented behavior continues directly into automatic collection, waiting, report generation, and persistence once confirmation logic is satisfied by the backend. Because these are chained paid and stateful actions, a mistaken trigger or ambiguous consent can result in unintended charges and external task execution with little opportunity for user intervention.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 95% confidence
• Finding: The instruction to proceed automatically whenever quote returns autoConfirm:true delegates spending control to the remote service rather than preserving agent-side consent checks. That is dangerous because the skill can transform broad natural-language requests into billable actions without a clear, platform-local approval event.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 91% confidence
• Finding: Allowing the agent to change persistent auto-confirm thresholds on the user's behalf creates delegated spending authority that can outlast the current task. Even if triggered by a natural-language phrase, this is an account-setting change with financial consequences and should not be treated as a lightweight convenience action.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**

• Confidence: 87% confidence
• Finding: The workflow normalizes minimal confirmations such as a single '好' after abbreviated pricing, which increases the chance of accidental authorization in multilingual or ambiguous conversations. While not inherently malicious, this reduces the robustness of consent for billable actions in a capability-rich skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**
- 报告讲完只推一个下一步，附接口返回的成本，不写死月费用。用户同意再 `schedule --set weekly`。
- 不解释命令名，不列功能清单。用户问「还能做什么」时按他的产品状态给一条建议，不超过三句。

• Confidence: 85% confidence
• Finding: The skill uses backend autoConfirm mode to adapt behavior for 'new users' and to shape follow-on recommendations that can lead into scheduled paid monitoring. This makes the agent more proactive around monetized actions for users least likely to understand the billing model, increasing the risk of consent confusion even if schedule changes still nominally require approval.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The text says report language follows the user, but also states the CLI default is `zh` and non-Chinese replies require explicitly setting `--language en` or similar. This means a specific language is forced by default unless the system actively overrides it, which is a language-policy concern absent explicit user opt-in.

Static analysis

No suspicious patterns detected.