Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it can spend ARI credits without current approval and does not reliably enforce combined spending limits.
Before generating reports, select “ask before every charge.” Use dedicated quote commands for estimates; omitting --confirm does not guarantee a free preview. Explicitly approve recurring collection and review active schedules separately. A spending cap alone is insufficient until combined-cost enforcement is fixed.
scripts/ari.pyQuote-only deepdive can silently execute paid analysis
The CLI submits a paid analysis request despite omission of the confirmation flag. The same helper also defeats the intended quote-only downgrade when no main-product subscription is found.
scripts/ari.pyVOC reuses analysis-only auto-approval for a larger combined charge
A single VOC workflow can consume more credits than the user's configured no-confirmation limit without presenting the combined quote first. The code checks affordability, not whether the combined spend is authorized.
The behavioral scope extends substantially beyond keyword extraction into credit spending and persistent collection. This is not merely a metadata mismatch: instructions allow spending under provider-defined first-run rules and reviving unanswered quotes, creating a concrete path to charges without current, informed user approval.
The declared purpose is review-text keyword analysis, but the supplied commands concern persistent scheduled monitoring and its management. These are additional user-facing capabilities, not merely implementation details of keyword extraction. The chunk does not show keyword extraction or establish that monitoring is limited to review word frequencies. Because the CLI implementation is not supplied, the assessment concerns the capabilities exposed by these commands, not verified execution or charges.
声明描述的是评论文本关键词统计与提取，而提供的命令执行的是持久化监控任务的生命周期管理，并涉及定期调度及刷新价格确认。这些是声明未披露的独立能力，不只是关键词提取的实现细节。片段未展示实际收费或监控数据内容，因此不据此推断已经扣费或具体监控指标。
The comparison workflow says binding a competitor starts weekly collection but does not locally require a separate recurring-cost quote and approval for that binding. This creates an authorization ambiguity where consent to a one-time comparison could be expanded into persistent collection, despite general instructions elsewhere requiring recurring-charge authorization.
The declared purpose is review-text keyword analysis, but the supplied commands expose a recurring monitoring lifecycle and pricing acceptance, neither of which is disclosed. No command shown explicitly performs word-frequency, co-occurrence, or positive/negative keyword extraction. Although monitoring might support review analysis, managing scheduled, potentially paid watches is a material additional capability rather than merely an implementation detail. The underlying ari.py implementation is not supplied, so its exact data access and billing effects cannot be verified.
The declared purpose describes review-text keyword analysis, but the supplied commands manage persistent collection schedules rather than analyze review language. Enabling recurring, potentially billable collection is a material capability beyond an ordinary implementation detail of keyword extraction. The CLI implementation is not supplied, so its exact collection and billing behavior cannot be independently verified.
The supplied command requests a category leaderboard using leaderboard --category "Kitchen" --by neg_rate; it does not request word frequencies, co-occurrences, or positive/negative keyword extraction. Ranking category entries by negative-review rate is a materially different analytical function from the declared purpose. The code shown does not establish any additional side effects from --confirm.
The supplied commands concern watch monitoring and historical reporting, which are not described in the declared review-keyword extraction purpose. They do not visibly perform review word-frequency analysis, co-occurrence extraction, or positive/negative wording classification. The underlying CLI implementation is not supplied, so this assessment is limited to the operations explicitly invoked.
The supplied commands concern watch monitoring and its pricing, not review-text keyword extraction, word frequency, co-occurrence, or sentiment grouping. These capabilities are not disclosed in the description, and the snippet does not establish that they support the declared workflow. The underlying ari.py implementation is not provided, so this assessment is limited to the visible commands and accompanying comment.
The supplied commands expose watch-related quoting and listing functionality that is not described by the review-keyword extraction purpose. The chunk does not show word-frequency analysis, co-occurrence extraction, or positive/negative wording classification. This assessment is limited to the visible commands; their underlying implementation is not supplied.
The supplied command targets alerts, rather than an identifiable review word-frequency or keyword-extraction operation. Alert functionality is not declared in the description, indicating a purpose mismatch. Because the script implementation is unavailable, the exact alert behavior and any resource access cannot be determined.
The supplied command explicitly selects '--type compare' and supplies '--competitor', indicating a comparative analysis workflow rather than the declared review-word-frequency extraction workflow. The underlying script is not supplied, so its precise outputs and resource access cannot be verified; the mismatch assessment is limited to the explicitly selected comparison capability.
The supplied command explicitly selects '--type compare' and supplies '--competitor', indicating a comparison workflow rather than the declared review-word-frequency workflow. The implementation of ari.py is not supplied, so the exact comparison output and any underlying data access cannot be verified. The mismatch is limited to the explicitly invoked, undeclared comparison capability.
The supplied command selects '--workflow audit --focus full', which indicates a broader audit operation not disclosed in the narrowly scoped review-keyword description. No review-text extraction, word-frequency calculation, co-occurrence analysis, or sentiment-based grouping is visible. The underlying script is not supplied, so the audit's exact actions and whether it includes keyword analysis cannot be verified.
The supplied command selects operations quote --workflow audit --focus full, rather than a review analysis or keyword-frequency operation. This indicates an undeclared audit-quotation capability. The CLI implementation is not provided, so the snippet does not establish what the audit covers, whether data is retrieved, or whether any audit is actually executed.
The supplied command selects a benchmarking operation, while the description promises review word-frequency, co-occurrence, and sentiment-separated keyword analysis. No such extraction is visible in this chunk. The mismatch assessment is limited to the exposed command: without scripts/ari.py, its underlying behavior and resource access cannot be confirmed.
run_analysis converts an unconfirmed invocation into a paid execution when the server returns a truthy autoConfirm value and sufficient balance. This contradicts the documented explicit-confirmation contract and also affects deepdive, whose attempted quote-only downgrade can still execute analysis.
The documented policy lets a server-provided autoConfirm value substitute for confirmation before spending account credits. The surrounding changelog describes default automatic execution without an amount ceiling; a server policy is not necessarily evidence of the user's authorization to spend. This is a documented consent-boundary concern, although the changelog alone cannot establish whether the packaged implementation exposes it.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
This passage explicitly describes automatically collecting data and generating a paid report, with the first N paid operations having no amount ceiling under server policy. A request for analysis does not necessarily authorize unbounded credit spending, and reporting charges afterward does not provide advance consent. User-defined thresholds and insufficient-balance checks reduce exposure but do not establish a safe default spending limit.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This match belongs to the same automatic-spending policy as the finding at line 32, rather than a separate vulnerability. Avoiding inference from explanatory text is reasonable, but relying solely on the server's boolean remains unsafe if no explicit user-approved spending policy exists. The changelog says explicit requests for confirmation are preserved, which limits but does not eliminate the default-consent concern.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This is a duplicate match within the same documented automatic-spending policy, not an additional independent defect. The concern is delegation of spending authorization to a server flag without a default amount ceiling, not the mere appearance of autoConfirm-related field names. Runtime exposure remains unverified because only the changelog is supplied.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
The changelog extends automatic paid execution to keywords analysis, making the consent concern directly relevant to this skill's advertised purpose. Returning charges after generation does not prevent unwanted credit consumption when autoConfirm is enabled without explicit spending authorization. This is another affected operation of the same underlying issue, not evidence of malicious intent.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill treats provider-defined first-run and remaining-use exemptions as sufficient authority to spend credits, explicitly without an amount limit for new users. Unlike a user-selected spending threshold, these defaults do not establish informed approval of the current charge, and disclosure only afterward cannot supply that approval.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）