亚马逊差评回复助手 · AI生成回复话术

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:37 AM UTC
• Version: 1.4.8

Overview

The skill is not plainly malicious, but it can spend ARI credits and change account monitoring or billing behavior with too much automatic authority for a review-reply assistant.

Install only if you trust ARI/funewa with your Amazon review data and want the agent to use ARI credits. Before using it, consider setting “ask every time before spending credits,” avoid enabling custom API base URLs, and review any request to turn on monitoring, add competitors, export files, or change autoconfirm settings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()

• Confidence: 65% confidence
• Finding: The export/download path sends an Authorization bearer token to whatever base_url() returns, and in custom-base mode the destination can be environment-controlled. Although the code requires ARI_ALLOW_CUSTOM_BASE=1, once enabled a malicious or compromised shell/session can redirect credentialed downloads to an attacker-controlled host, exposing the API key and any exported data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to execute a local CLI, use environment/API keys, write local configuration, and make networked requests, but it does not declare permissions. This creates a hidden capability gap where a user or platform may believe the skill is informational while it can actually access secrets, modify local state, and perform external actions including billable operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The published description frames this as a narrow negative-review reply assistant, but the instructions expose a much broader operational surface: paid collection, reporting, exports, competitor management, watches, product operations, and account-affecting settings. That mismatch undermines informed consent and can cause the agent to trigger sensitive or billable actions that users would not reasonably expect from the advertised skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The README markets this as a narrow negative-review reply assistant, but the documented capabilities expand into broader review analytics, competitor comparison, report generation, exports, billing-triggering workflows, and monitoring. This scope expansion can mislead users and calling agents about what actions and data access the skill may perform, increasing the risk of unintended data processing or paid operations beyond the user’s apparent request.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill metadata describes a negative-review reply assistant, but the implementation includes broad product operations, competitor monitoring, benchmarking, leaderboard, radar, and workflow automation capabilities. This scope expansion violates least privilege and increases the chance that an agent invokes higher-risk business functions the user did not intend to expose through this skill.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Account state and billing-related controls such as balance inspection and autoconfirm policy management exceed the stated purpose of drafting replies to negative reviews. In an agent setting, these functions can change spending behavior or reveal account details without being necessary for the core workflow.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The skill can export remote data and write arbitrary local files, which is broader than a review-reply assistant and creates a larger data-handling surface. While not inherently malicious, local persistence of exported review/report data can lead to unintended disclosure, especially in shared or automated environments.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring says paid collection and AI analysis require an explicit --confirm flag, but later logic auto-confirms some paid actions based on server policy. This mismatch can mislead users or calling agents into believing no chargeable action will occur without explicit confirmation, undermining consent and spend control.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrases are broad everyday requests around reviews, communication, and after-sales work, without strong boundaries limiting when the skill should activate. In combination with the skill's large action surface, this increases the chance of overbroad invocation and unintended execution of external or billable workflows.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 95% confidence
• Finding: This workflow explicitly instructs the agent to run a paid VOC command by default and accept server-side auto-confirmed charges without fresh per-action consent. Even if the backend allows it, the agent is being told to initiate billable external actions automatically, which is dangerous in a conversational setting because user intent may be ambiguous and costs are incurred before confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 94% confidence
• Finding: The skill tells the agent to proceed with auto-confirmed paid generation and only ask for confirmation when the server demands it. That delegates spending authority to remote policy instead of the user, increasing the risk of unauthorized charges and external side effects such as collection jobs and report creation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 95% confidence
• Finding: The billing section normalizes direct generation when `autoConfirm: true`, which instructs the agent to rely on backend heuristics instead of explicit consent in the current conversation. In an agent environment, that is risky because the model may misclassify requests and trigger paid actions under broad natural-language prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: The same instruction encourages the agent to operationalize informal phrasing like '50以内直接做' into a persistent billing policy change. Natural-language ambiguity, impersonation, or prompt confusion could cause the agent to broaden spending authority beyond what the user intended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: The same instruction encourages the agent to operationalize informal phrasing like '50以内直接做' into a persistent billing policy change. Natural-language ambiguity, impersonation, or prompt confusion could cause the agent to broaden spending authority beyond what the user intended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**
- 报告讲完只推一个下一步，附接口返回的成本，不写死月费用。用户同意再 `schedule --set weekly`。
- 不解释命令名，不列功能清单。用户问「还能做什么」时按他的产品状态给一条建议，不超过三句。

• Confidence: 78% confidence
• Finding: The section uses account `autoConfirm.mode` to shape how assertively the agent proposes next actions for 'new users,' reinforcing an automation pattern driven by backend state rather than explicit user intent. In context with the broader paid workflow, this makes accidental escalation more likely, though the specific line is less severe than direct execution instructions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 78% confidence
• Finding: This duplicate finding points to the same account-level `autoconfirm` capability, which can alter future consent behavior beyond the current interaction. That persistence makes it more dangerous than a one-off command because it can silently normalize autonomous spending if an agent is allowed to use it.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 78% confidence
• Finding: This duplicate finding points to the same account-level `autoconfirm` capability, which can alter future consent behavior beyond the current interaction. That persistence makes it more dangerous than a one-off command because it can silently normalize autonomous spending if an agent is allowed to use it.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

emit(balance, args.compact)
        return
    # 免确认策略（1.4.5）：告诉 agent 当前用户是「小额直接生成」还是「每次先问」
    auto = request_json("GET", "/api/v1/user/autoconfirm")
    emit({"success": True, "data": {
        "skillVersion": VERSION,
        "release": release,

• Confidence: 91% confidence
• Finding: The skill explicitly supports an auto-confirm model for paid operations, meaning an agent may proceed with billable actions without a fresh per-action confirmation from the user. In an agent environment, that weakens transactional consent and can lead to unintended charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"release": release,
        "user": data_of(me),
        "balance": data_of(balance),
        "autoConfirm": data_of(auto) if ok(auto) else None,
    }, "links": links()}, args.compact)

• Confidence: 91% confidence
• Finding: Exposing and relying on autoConfirm state encourages downstream automation to make spending decisions without explicit runtime approval. For a skill tied to paid analysis and collection, this creates a meaningful risk of unauthorized or surprising charges.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}, "links": links()}, args.compact)


AUTOCONFIRM_MODE_NOTE = {
    "always_ask": "每次付费操作都会先报价、等你确认。",
    "user_limit": "{limit} 积点以内的操作直接生成，超过才问你。",
    "free_small": "免费版 {max} 积点以内的操作直接生成（用的是赠送积点）。",

• Confidence: 88% confidence
• Finding: The presence of autoconfirm modes formalizes autonomous paid execution behavior. That is risky in a skill ecosystem because the skill's functional scope includes billable collection, analysis, and operations tasks that can be triggered without immediate user awareness.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:

• Confidence: 90% confidence
• Finding: A command dedicated to changing the autoconfirm threshold allows the tool to relax its own spending controls. In an agent-mediated environment, modifying this policy is sensitive because it can enable later billable actions to proceed automatically.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This logic accepts values that can disable repeated confirmation for paid actions. The danger is not the parsing itself but that the skill exposes a control plane for autonomous spending decisions beyond its stated review-reply purpose.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This logic accepts values that can disable repeated confirmation for paid actions. The danger is not the parsing itself but that the skill exposes a control plane for autonomous spending decisions beyond its stated review-reply purpose.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This logic accepts values that can disable repeated confirmation for paid actions. The danger is not the parsing itself but that the skill exposes a control plane for autonomous spending decisions beyond its stated review-reply purpose.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

• Confidence: 90% confidence
• Finding: The PUT to /user/autoconfirm changes billing-related execution policy, enabling future actions to run without confirmation under a chosen credit limit. In the context of a paid agent skill, this is a meaningful authorization and consent risk.

Static analysis

No suspicious patterns detected.