Security audit
Security checks for vulnerabilities and agentic risk
This skill can spend account credits during a supposed preview and revive unanswered requests in later conversations.
Before requesting analysis, choose “ask before every charge” using autoconfirm off. Use quote for estimates and request --schedule manual for one-time collection. Review recurring product and competitor plans separately. Do not assume deepdive is free or that unanswered quotes will remain inactive.
scripts/ari.pyQuote-only deepdive can execute paid analysis
A preview can generate and archive a paid VOC report and consume credits without the command's promised explicit confirmation. When the main-product lookup fails, the output can additionally claim that analysis was downgraded and no credits were charged despite this execution path.
scripts/ari.pyRecurring collection enrollment lacks an executable confirmation gate
The account can acquire recurring collection charges beyond the current operation. Existing authentication restricts the action to the account but does not enforce separate consent to ongoing billing.
The supplied commands manage persistent, scheduled monitoring rather than analyze review sentiment or summarize attribute-level positive and negative themes. Recurring watches, competitor monitoring, and price acceptance are materially distinct capabilities not disclosed in the declared purpose. The implementation of the CLI is not supplied, so this assessment is limited to the operations explicitly invoked.
The sentiment-analysis entry point includes materially broader financial and persistent monitoring capabilities. Most have explicit authorization safeguards, but automatic spending under service-defined defaults and competitor binding that starts weekly collection leave concrete consent gaps rather than merely a naming mismatch.
The description declares review sentiment analysis by theme, not recurring monitoring or management of persistent watches. These commands introduce scheduling, competitor tracking, and price acceptance that are materially beyond the stated purpose. Although the underlying script is not supplied and execution is not demonstrated, the exposed command operations clearly represent undeclared capabilities.
The declared purpose concerns review sentiment classification and theme-level aggregation. The supplied chunk instead documents a recurring monitoring workflow with persistent watch lifecycle operations and price-acceptance parameters. These are material capabilities not disclosed in the description, rather than incidental sentiment-analysis implementation details. The underlying script is not supplied, so actual billing, collected data, and backend effects cannot be verified.
The supplied commands manage ongoing data-collection schedules rather than analyze review sentiment. Enabling recurring, potentially billable collection is a distinct operational capability not disclosed in the description, rather than merely a supporting sentiment-analysis implementation detail. The underlying script is not supplied, so this assessment is limited to the explicit command invocations and their annotations.
The supplied commands concern watch management and pricing rather than review sentiment classification or thematic aggregation. These capabilities are not declared, and the chunk provides no evidence that they support the stated sentiment-analysis workflow. The implementation of ari.py is not supplied, so this assessment is limited to the visible commands and their annotation.
The comparison workflow describes binding a competitor as a step that automatically starts weekly collection, without attaching a dedicated recurring-cost quote and consent requirement to that binding. A user authorizing a one-time comparison could therefore acquire a persistent collection subscription they did not authorize; general scheduling safeguards reduce but do not resolve this ambiguity.
The supplied commands concern watch or monitoring functionality, not review sentiment classification or thematic aggregation. The description does not declare watch management or monitoring-cost queries, and the chunk provides no evidence that these operations support sentiment analysis. The underlying script is not supplied, so this assessment is limited to the visible commands and comments.
The only visible action is python scripts/ari.py alerts, which selects an alerts operation rather than a sentiment-analysis operation. This appears materially inconsistent with the declared purpose. However, the script implementation is not supplied, so the precise effects of the command, including resource access or side effects, cannot be verified.
The supplied commands concern watch-based monitoring and historical reporting, capabilities not described in the declared review-sentiment analysis purpose. No sentiment classification or attribute-level positive/negative aggregation is visible. Although monitoring could support a broader review-analysis workflow, the supplied chunk does not establish that connection. The underlying CLI implementation is not provided, so its precise data access and outputs cannot be verified.
The supplied command explicitly selects --type compare and supplies --competitor, indicating a competitive comparison workflow rather than the declared theme-based sentiment analysis. The script implementation is not provided, so its exact outputs and data access cannot be established, but the visible invocation exposes an undeclared comparison capability.
The command explicitly selects '--type compare' and supplies '--competitor', indicating a cross-product comparison rather than the declared sentiment-analysis workflow. The Amazon resource context is consistent, but the requested comparison capability is undeclared. Because the implementation of ari.py is not supplied, the exact comparison output and any further effects cannot be established.
The command explicitly selects operations quote --workflow audit --focus full, which indicates a full-audit quotation operation rather than a sentiment-analysis workflow. The Amazon product and marketplace arguments align with the declared domain, but the selected operation and scope do not match the advertised purpose. The supplied chunk does not include scripts/ari.py, so its internal behavior and any network activity cannot be verified.
The supplied command selects --workflow audit --focus full, which indicates a broader audit operation not disclosed in the sentiment-analysis description. The Amazon ASIN and ARI tooling are consistent with the stated context, but the selected operation is not. Because the implementation of scripts/ari.py is absent, the audit's exact effects cannot be established; no additional data access or side effects are inferred.
The supplied command explicitly selects a benchmark operation, which the description does not declare. It does not explicitly request sentiment classification or thematic aggregation. The underlying ari.py implementation is not supplied, so the exact benchmarking behavior and any overlap with sentiment analysis cannot be verified.
The skill instructs the agent to revive an unanswered quote in a later conversation and proceed directly to report generation when automatic confirmation applies. Silence on an old quote is not authorization, and an unrelated later session could trigger unwanted credit spending at a potentially changed price.
run_analysis changes an absent confirmation into authorization to spend credits based solely on the server's autoConfirm value, contradicting the module's explicit-confirmation contract. This also affects deepdive, whose attempted downgrade to quote-only can still execute paid analysis; the supplied code does not establish that the user previously authorized this delegation.
The collection command defaults new products to weekly collection and recurring credit deductions, although a sentiment-analysis request does not inherently authorize ongoing monitoring. The CLI help and collection quote disclose this behavior and collection requires confirmation, which reduces the risk, but a generic confirmation can still authorize more than an intended one-time collection.
In context, the server's autoConfirm flag can authorize spending credits without the user accepting a quote or explicitly enabling automatic spending. This is a financial-consent weakness rather than inherently unsafe autonomy: trusting a structured server flag is reasonable, but the documented default policy does not establish user authorization.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented policy permits the first N paid generations without an amount limit, automatically collecting reviews and charging credits before presenting the final costs. Honoring explicit confirmation preferences and checking available balance reduce exposure, but neither establishes consent to an unspecified charge; introductory gift credits also do not guarantee a cost bound.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This occurrence is part of the same automatic-charging policy, not a separate exploit. Using a Boolean instead of interpreting explanatory prose is sound, but the surrounding policy still allows that Boolean to authorize spending without prior user opt-in or an amount ceiling.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This duplicates the preceding finding at the same location and describes the same financial-consent weakness. The problematic element is not the autoConfirm identifier itself, but the surrounding policy allowing paid work without explicit spending authorization or a default amount limit.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
The changelog extends direct execution under autoConfirm to multiple analysis types, expanding the same spending-consent weakness beyond VOC generation. Returning charges afterward provides transparency but does not prevent unwanted credit consumption; the sentiment-analysis context makes paid analysis relevant, not automatically authorized.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.