亚马逊评论采集 · 批量抓取导出

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:37 AM UTC
• Version: 1.4.8

Overview

This skill is a real Amazon review tool, but it can spend ARI credits and change ongoing account settings with broader authority than its scraper/export name suggests.

Review before installing. Use this only if you trust ARI with Amazon review data and are comfortable with a local API key plus credit-based operations. Consider setting autoconfirm off, saying 'only quote, do not execute' for price checks, and being explicit before enabling schedules, watches, competitor tracking, or file exports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()

• Confidence: 70% confidence
• Finding: The export/download path writes arbitrary response bodies to a caller-supplied local path via --out, with no restriction on destination, symlink handling, or overwrite policy. In an agent context, a malicious or confused instruction could cause sensitive local files to be overwritten or planted with attacker-controlled content fetched from the remote service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of shell execution (`python scripts/ari.py`), network access to a remote API, local key storage/configuration, and report/export operations, yet no permissions are declared. That mismatch creates a trust and sandboxing problem: the host may under-enforce safeguards or users may not understand that the skill can execute commands, access environment secrets, and write files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is narrow review scraping/export, but the skill also enables paid AI analysis, account configuration, watch management, competitor operations, scheduled tasks, and browser-based authorization. This description-behavior gap increases the risk of informed-consent failure, where a user invokes a seemingly limited scraper but actually authorizes broader account changes or billable actions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill metadata describes Amazon review scraping/export, but this file exposes materially broader capabilities such as product operations, monitoring, workbench actions, and watch/event management. In an agent environment, that scope mismatch can enable actions a user or platform policy did not intend to grant, undermining least privilege and consent expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code explicitly bypasses explicit user confirmation for paid analysis when the server returns autoConfirm=true and sufficient balance, despite the skill description promising confirmation before charges. In an agent setting, this can lead to unapproved billable actions triggered by normal conversation flow, creating real financial impact and trust violations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The one-click VOC path can automatically collect reviews and run paid analysis in one operation, which exceeds a narrow scrape/export expectation and increases the chance of unintended spend or broader data processing. Combined workflows are especially risky in agent contexts because a single ambiguous instruction can trigger multiple side effects.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The usage guide materially expands the skill’s apparent capabilities far beyond the manifest’s stated scope of Amazon review scraping/export. This is dangerous because an agent or user may authorize actions they did not reasonably expect from the installed skill, including paid analysis, monitoring, operations workflows, competitor tracking, and other account-affecting features, increasing the risk of overbroad tool use, unintended charges, and data access.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The guide tells users the dedicated skill is focused on its own scenario, but later documents broad unrelated workflows such as operations, watch, alerts, benchmark, leaderboard, and competitor management. This inconsistency can mislead an agent into trusting the skill as narrowly scoped when it actually exposes much broader functionality, weakening informed consent and increasing the chance of unintended privileged actions.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The invocation guidance uses broad natural-language triggers, which can cause the agent to activate this skill for loosely related requests. Because the skill can initiate networked scraping, paid operations, exports, and account-affecting workflows, overbroad triggering raises the chance of unintended execution.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The manifest description similarly uses ambiguous invocation guidance around scraping/export requests without clearly bounding when the skill should and should not run. In context, that matters because the skill includes billable and state-changing operations beyond read-only retrieval.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 93% confidence
• Finding: The workflow directs the agent to run paid VOC generation by default and to accept server-side `autoConfirmed: true` as sufficient to proceed without user confirmation. That enables spending credits and generating reports before obtaining fresh, explicit consent in the current conversation, which is especially risky for a skill with real billing consequences.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 91% confidence
• Finding: This step instructs the agent to proceed from default VOC execution into automatic collection/waiting/report generation, with confirmation only if the API says it is required. Security-wise, that outsources user-consent decisions to the remote service and allows autonomous billable execution by the agent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 93% confidence
• Finding: The skill explicitly tells the agent to directly generate paid results when `autoConfirm: true` is returned, rather than asking the user. In this context, automatic spending is more dangerous because the skill is framed as natural-language, low-friction tooling for non-technical users, making accidental charges more likely.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: The same `autoconfirm` control is dangerous because it changes future transaction behavior beyond the current task. In a skill that already has broad activation wording and many billable workflows, reducing confirmations can magnify downstream accidental execution risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: The same `autoconfirm` control is dangerous because it changes future transaction behavior beyond the current task. In a skill that already has broad activation wording and many billable workflows, reducing confirmations can magnify downstream accidental execution risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch delete` | product-operations/watches/{id}（DELETE） | 否；不删除商品资料、评论或历史报告 |
| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |

• Confidence: 92% confidence
• Finding: The reference explicitly permits paid `analyze` operations to proceed when server-side `autoConfirm` rules are met, meaning the agent may trigger billable actions without obtaining an explicit per-action user confirmation. In an agent skill that can act on a user's behalf, this creates a genuine autonomous decision-making risk because credits may be consumed based on policy state rather than current user consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: The `autoconfirm` feature changes account-level consent behavior for future paid actions, so it is not just a one-time operational choice but a persistent policy mutation. In a delegated agent environment, that persistence increases risk because later commands may spend credits automatically without renewed user awareness.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: The `autoconfirm` feature changes account-level consent behavior for future paid actions, so it is not just a one-time operational choice but a persistent policy mutation. In a delegated agent environment, that persistence increases risk because later commands may spend credits automatically without renewed user awareness.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 97% confidence
• Finding: This section states that `voc` may directly generate results when server-side no-confirmation rules match and total cost is below a threshold, combining collection, waiting, analysis, and archival automatically. That is a real autonomous spending path: the agent can trigger multi-step paid work without an explicit confirmation in the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 96% confidence
• Finding: The quote response includes `autoConfirm` metadata indicating the service may allow immediate execution of paid analysis. In isolation this is informational, but in this skill context it directly supports an execution path where the agent can decide to proceed without explicit user confirmation, which is unsafe for billable operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 96% confidence
• Finding: The same line documents direct execution under `autoConfirm`, which creates a concrete risk of unintended charges and data collection without fresh consent. Because the skill is designed for scraping and exporting review data at scale, the surrounding context increases the practical likelihood and consequence of over-collection or surprise spend.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 96% confidence
• Finding: The same line documents direct execution under `autoConfirm`, which creates a concrete risk of unintended charges and data collection without fresh consent. Because the skill is designed for scraping and exporting review data at scale, the surrounding context increases the practical likelihood and consequence of over-collection or surprise spend.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 94% confidence
• Finding: `autoConfirmNote` and related fields normalize the concept that paid execution can proceed without a current user prompt, which weakens the consent boundary expected in agent-mediated transactions. The risk is not malicious code execution, but unauthorized economic action by the agent on behalf of the user.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 94% confidence
• Finding: Repeated references to `autoConfirmed` around paid VOC/report generation indicate that the design intentionally supports backend-driven consent bypass for eligible cases. In an AI agent setting, that is a real vulnerability because the model may interpret eligibility as authorization and spend credits or collect data beyond what the user just requested.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 94% confidence
• Finding: Repeated references to `autoConfirmed` around paid VOC/report generation indicate that the design intentionally supports backend-driven consent bypass for eligible cases. In an AI agent setting, that is a real vulnerability because the model may interpret eligibility as authorization and spend credits or collect data beyond what the user just requested.

Static analysis

No suspicious patterns detected.