Security audit
Security checks for vulnerabilities and agentic risk
This skill can spend ARI credits without price approval, despite promising to ask first, and competitor tracking can initiate recurring charges.
Before using paid features, set the account to ask before every charge and obtain a free quote. Request manual collection for one-time work, approve competitor monitoring costs separately, and do not assume deepdive is read-only. The package needs consistent billing safeguards before relying on its confirmation promises.
scripts/ari.pyRecurring paid collection can be enabled without an executable confirmation gate
Recurring collections can consume account credits beyond an authorized one-time analysis or product-management action. Competitor billing requires the primary product to remain monitored.
scripts/ari.pyDeepdive's quote-only mode can silently become paid analysis
A user or integration relying on deepdive's non-executing default can be charged and have a report generated without requesting paid generation.
The manifest promises quotation and confirmation before charges, but the workflow explicitly permits server-default first-run rules to trigger collection and paid analysis without advance price acceptance. This is a concrete billing-consent failure, rather than merely an expanded feature set; explicitly user-configured spending thresholds are a different case.
Although these commands concern Amazon ASINs and include pricing acceptance, they expose an ongoing monitoring workflow rather than merely supporting a batch review-collection job. Recurring watches, competitor tracking, and monitoring reports are material capabilities not disclosed in the declared description. The chunk does not establish unrelated resource access or malicious behavior.
Scheduled watches and their lifecycle are materially broader than the declared batch review collection and export workflow. Viewing collection progress does not adequately disclose ongoing weekly monitoring, competitor watches, or historical monitoring reports. The commands include explicit price-acceptance arguments, so this chunk does not establish unauthorized charging; the mismatch is the undeclared recurring monitoring capability.
Recurring collection and monitoring are substantive capabilities not disclosed in the description, which describes collection with a quote-and-confirm payment flow. The chunk explicitly introduces automatic weekly execution and associated future costs. However, the underlying implementation is not supplied, so this does not establish that quotation or confirmation safeguards are bypassed.
The comparison workflow says binding a competitor starts weekly collection, but does not attach an explicit recurring-cost quotation and acceptance step to that binding action. Consent to a one-time comparison or competitor association should not be treated as consent to ongoing paid collection; general scheduling safeguards elsewhere leave this transition ambiguous.
The commands remain related to Amazon data collection, but they expose persistent, scheduled monitoring rather than only the declared batch review collection and export workflow. Weekly refreshes and watch lifecycle controls are substantive user-facing capabilities not disclosed in the description. The snippet does not establish what data each watch collects, so no additional data-access or exfiltration behavior is inferred.
The supplied command explicitly selects 'analyze --type compare' and provides a competitor ASIN, rather than requesting review collection, browsing, or export. Comparative analysis is a distinct, undeclared capability. The snippet does not expose the CLI implementation, so it does not establish whether credits are charged or whether a quotation is shown.
The command explicitly requests 'analyze --type compare' with a '--competitor' argument. This is a distinct user-facing analytical capability, not simply an implementation detail of collecting or exporting reviews. Although it uses Amazon ASINs and a supported marketplace, the declared description does not mention competitor comparison. The underlying script is not supplied, so its data access, charging behavior, and analysis implementation cannot be verified.
The declared description covers ASIN-based review collection and review-data browsing/export, not category-level product ranking or leaderboard analytics. The supplied command invokes this undeclared capability rather than a collection or export operation. The underlying script is not provided, so additional effects, including charging or data access, cannot be established.
The description includes collection progress tracking, but the supplied commands expose a distinct watch-oriented interface for historical summaries, events, and time series rather than review collection or export. This appears to be an undeclared monitoring capability. Because the implementation of ari.py is not supplied, the exact monitored data and any underlying resource access cannot be established.
The watch commands and frequency-based monthly estimates indicate an ongoing monitoring feature, which is not disclosed in the description of batch review collection. Tracking collection progress and quoting a collection job do not adequately describe recurring monitoring. The supplied commands only query watch information; they do not demonstrate creating watches or charging credits.
Quotation is consistent with the declared pre-charge process, but the command selects '--workflow audit --focus full', indicating a different workflow from the declared review-collection purpose. The supplied chunk does not establish what that audit includes, nor does it show collection, charging, or data export.
The supplied command targets a review-advice operation rather than the declared Amazon review collection workflow. This is an undeclared capability, not merely an implementation detail of collection or export. The implementation of ari.py is not supplied, so the command alone does not establish what advice is produced, whether credits are charged, or whether any external resources are accessed.
The supplied command explicitly selects an audit workflow rather than a review-collection, browsing, or export operation. Although the ASIN and marketplace match the declared domain, they do not establish that the audit is a supporting review-collection step. The underlying script is not supplied, so the audit's exact effects, resource access, and any charges cannot be verified.
These instructions explicitly allow collection, report generation, and credit deduction before price confirmation under server-default first-run or remaining-use rules. Server permission is not evidence of user spending consent, and post-charge disclosure cannot satisfy the manifest's promise of advance confirmation.
The skill treats an unanswered earlier quotation and an idle product as grounds to announce and immediately generate a report in a later conversation. Combined with automatic confirmation, this can spend credits without a current request or acceptance; silence and persistent product state are not authorization.
The documented VOC workflow can collect reviews, generate analysis, and deduct credits based on server-defined first-use allowances rather than explicit user approval. This contradicts the skill description's quote-before-confirmation promise; a server eligibility flag does not establish that the user authorized the expenditure.
Collection defaults to a weekly recurring schedule even though the advertised task is a page-bounded collection. Approval of the immediate collection price does not necessarily authorize future recurring charges, and requiring an explicit manual option makes unintended enrollment likely.
run_analysis changes confirm=False to True when the remote quote supplies a truthy autoConfirm value, then invokes a billed analysis endpoint. This contradicts the explicit-confirmation contract and also makes deepdive's purported quote-only downgrade unreliable; cmd_voc contains a similar bypass that can additionally charge for collection.
A normal batch collection defaults to weekly recurring collection and deductions for new products. Although the quote discloses monitoring, confirming a requested batch can still establish ongoing spending without a separate recurring-payment opt-in.
In context, this documents relying on a server-provided autoConfirm flag to authorize credit-consuming actions without transaction-specific confirmation. The later release notes describe default eligibility rather than necessarily user-granted authorization, conflicting with the skill's stated quote-and-confirm contract; implementation is not available to verify enforcement.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented policy allows the first N paid generations without an amount ceiling, including automatic collection, analysis, and credit deductions. Gift-credit coverage and insufficient-balance checks reduce exposure but do not establish informed spending consent or prevent unexpected consumption of available credits.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This extends the same server-controlled automatic-spending policy to multiple analysis types, generating results and reporting charges afterward. Without verified standing user authorization, a server eligibility flag can cause unexpected credit deductions; this is the same underlying consent issue, not an independent exploit.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。