Security audit
Security checks for vulnerabilities and agentic risk
Review recommended: this export skill can spend account credits without approval, including through a command advertised as free by default.
Before using paid features, select the account's “ask every time” setting. Use manual collection for one-time exports and review existing recurring schedules. Do not rely on deepdive's quote-only or no-charge promise until the confirmation bug is fixed.
scripts/ari.pyDeepdive's quote-only restriction can be overridden by automatic confirmation
Deepdive can consume account credits when its documented behavior promises a quote only. In the missing-main-product case, it can additionally claim that no credits were charged despite reaching the paid execution path.
The export-focused description understates workflows that can spend account credits without first presenting a price, including uncapped server-defined introductory auto-confirmation. Explicit consent requirements protect several monitoring and operations workflows, but do not resolve this separate spending-authorization gap.
The declared purpose concerns review collection and file/report export. The supplied chunk instead exposes persistent monitoring and watch-management operations, including scheduled refreshes with price acceptance. These are material additional capabilities, not merely implementation details supporting export. No CSV, Markdown, or HTML export operation is shown in this chunk.
The supplied commands manage recurring watches rather than exporting reviews or reports. Persistent scheduled monitoring, competitor tracking, and price acceptance are material capabilities not disclosed by the export-focused description. No CSV, Markdown, or HTML export operation appears in this chunk.
The declared purpose covers review collection and file/report export, but does not disclose managing recurring monitoring or enabling potentially billable automatic collection. The supplied commands explicitly expose those scheduling capabilities rather than export operations. Although the underlying script implementation is not shown, the command interface and accompanying comments support this mismatch.
The declared purpose centers on on-demand review collection and local data/report exports. The supplied chunk instead exposes persistent monitoring workflows, including scheduled refreshes and price acceptance, which are substantive undeclared capabilities rather than export implementation details. No CSV, Markdown, HTML, or local export operation is shown. Since the chunk contains command examples rather than the underlying implementation, the assessment concerns the exposed command behavior, not verified execution or billing.
Competitor monitoring and recurring collection materially extend beyond the declared review-export workflow. The competitor-add command establishes an ongoing monitoring relationship, while the radar command provides historical comparative analytics. Neither capability is disclosed in the description, and the supplied chunk shows no CSV or report export operation.
The supplied command performs a category-level ranking operation that is not described by the declared review-export purpose. It specifies neither an ASIN nor an export operation. The implementation of ari.py is not supplied, so additional behavior and the meaning of --confirm cannot be verified.
The supplied commands expose watch-monitoring functionality rather than the declared ASIN review collection and export workflow. They operate on a watch ID and request digests, events, and time-series data; no CSV export or Markdown/HTML report export is shown. These monitoring capabilities are not described in the declared purpose. The underlying script is not supplied, so this assessment is limited to the visible command invocations.
The supplied commands concern watch functionality rather than review collection or file/report export. This exposes an undeclared monitoring-management capability. The snippet does not establish that monitoring is enabled, charges are incurred, or any data is exported.
The visible command selects 'analyze --type compare' and supplies a competitor identifier. Competitor comparison is not described in the declared export-focused purpose. Although the description mentions AI analysis reports, it describes exporting those reports, not performing competitive analysis. The underlying script is not supplied, so actual data access, file creation, and API behavior cannot be verified.
The visible commands concern ongoing monitoring and its pricing, rather than collecting or exporting reviews or reports. These capabilities are not disclosed in the declared export-focused purpose. The underlying Python implementation is not supplied, so the assessment is limited to the commands and their accompanying description.
The command explicitly selects analyze --type compare and supplies a separate --competitor ASIN. Although the description mentions AI analysis reports, it does not disclose competitor-comparison functionality. This is a materially different workflow from collecting and exporting reviews for a specified ASIN. The implementation of scripts/ari.py is not supplied, so actual data access, file creation, and other side effects cannot be established.
The supplied command selects an alerts operation, which is materially different from the declared review and report export workflow. Nothing supplied establishes alerts as a supporting export step. The implementation of ari.py is not included, so the precise alert behavior and any resource access cannot be verified.
The visible command targets an individual review through an advice-oriented subcommand, which is not described as a capability in the declared purpose. No ASIN, export operation, output format, or output path is supplied. Although AI analysis reports are mentioned in the description, that does not establish that this confirmed review-specific operation is part of report export. The implementation of ari.py is not provided, so any further effects of advise or --confirm cannot be determined.
The visible command selects operations quote --workflow audit --focus full, which targets a full-audit quotation rather than the declared review-export workflow. No review collection, CSV export, or report export is shown. A quotation could be a supporting step, but the supplied chunk does not establish that connection. The underlying script is unavailable, so additional behavior cannot be assessed.
The visible command selects benchmark rather than a review collection or export operation. This indicates a purpose mismatch at the command level. However, the snippet does not reveal what the benchmark subcommand actually does, so no additional claims about network access, file exports, or data handling can be verified.
The supplied command explicitly runs an audit operation; it does not explicitly collect reviews or export CSV, Markdown, or HTML. Although an audit could potentially support the declared AI analysis feature, that relationship is not established by this snippet. The underlying script is unavailable, so its resource access, side effects, and any eventual exports cannot be determined.
Collection defaults to a weekly schedule, so obtaining data for a one-time export can also enable recurring paid collection. Confirmation of the initial collection price does not necessarily authorize ongoing charges, and the instruction to explicitly select manual for one-time use leaves an unsafe default in an export-focused skill.
run_analysis converts a server-provided autoConfirm value into local confirmation, allowing paid execution without --confirm despite the module's explicit-confirmation promise. cmd_voc similarly permits collection and analysis without explicit confirmation, and deepdive's intended quote-only downgrade can be bypassed through run_analysis; an export-oriented agent may therefore spend credits unexpectedly.
A confirmed collection defaults to weekly scheduling, creating continuing credit consumption rather than merely collecting data for an export. The quote and help text disclose this behavior, which reduces concealment, but a generic confirmation still bundles an ongoing financial commitment into a predominantly one-time export workflow.
The documented policy lets a server-provided autoConfirm flag replace confirmation before credit-consuming operations, without establishing that the user previously authorized this delegation. In an export-focused skill, automatic paid collection or analysis could exceed the requested scope; however, this changelog alone does not establish that the affected commands are reachable in this package.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The changelog explicitly describes automatically collecting reviews and generating a paid report without stopping for confirmation, with no amount ceiling for the first N paid generations. Gift credits, balance checks, and after-the-fact charge disclosure limit or explain spending but do not establish prior authorization to consume credits.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This is another match within the same documented automatic-spending policy, not an additional independent vulnerability. Avoiding inference from autoConfirmNote or autoConfirmRemaining is sensible, but relying on the boolean alone still leaves a consent gap if no user-approved spending policy exists.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This duplicates the consent weakness identified in the surrounding autoConfirm policy. The references to auxiliary fields are not themselves dangerous; the concern is that server eligibility can authorize uncapped initial paid generations without demonstrated prior user opt-in.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
The documented behavior extends automatic paid execution to multiple analysis types whenever autoConfirm is true. This broadens the same consent weakness: returning charges afterward does not prevent unintended credit consumption, although the supplied file does not prove these analysis commands exist in the export package.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。