ClawHub
Back to skill

Security audit

亚马逊运营助手 · 评论数据决策

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ARI Amazon review assistant, but it needs review because it can spend credits under auto-confirm rules and change account-level confirmation or monitoring settings.

Install only if you trust ARI with your Amazon review data and are comfortable with its credit-based billing model. Before using it, set the account to ask before every paid action if you do not want auto-confirmed reports, avoid inherited ARI_BASE_URL/ARI_ALLOW_CUSTOM_BASE settings unless you run a trusted self-hosted endpoint, and review monitoring or schedule changes because they can affect future collection costs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()
Confidence
80% confidence
Finding
This download path sends the Bearer API key to the URL derived from base_url(), which can be redirected to a non-official host when both ARI_BASE_URL and ARI_ALLOW_CUSTOM_BASE are set. Although that requires explicit local environment manipulation, in an agent or shell-integrated context such variables may be injected or inherited, turning this into credential exfiltration and arbitrary file content delivery from an attacker-controlled service.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill instructs the agent to use shell, network, environment variables, and local file writes (e.g. running CLI commands, reading references, storing API keys), but no explicit permissions are declared. This creates a capability/consent mismatch: the skill can access sensitive local state and make external requests without a clear permission boundary, increasing the chance of secret exposure, unintended filesystem modification, or unsafe command execution through the agent runtime.

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
The skill stores API keys locally and supports writing exports to local files, capabilities that exceed the manifest's review-analysis framing. In agent environments, broader-than-declared persistence and filesystem write behavior increases the attack surface and the chance of users authorizing actions they did not expect from this skill.

Description-Behavior Mismatch

Medium
Confidence
81% confidence
Finding
The skill includes watch management and product-operations workflows that are materially broader than the manifest's stated review-analysis assistant purpose. Hidden operational capabilities can cause users or higher-level agents to trigger monitoring, automation, or charged workflows without informed consent.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This code modifies the user's autoconfirm policy, changing whether future paid actions can proceed without an explicit prompt each time. For a review-analysis assistant, silently altering account confirmation behavior expands authority beyond expected read/analyze actions and can enable unintended spending later.

Intent-Code Divergence

Low
Confidence
74% confidence
Finding
The code claims to read immutable specialized-skill defaults but actually loads a mutable local JSON file at runtime. In an agent distribution context, local tampering with that file could alter workflow/focus defaults and cause unintended operations against different backend workflows than the user expects.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
Confidence
93% confidence
Finding
This workflow allows a paid operation to be executed automatically when the backend returns auto-confirmation, even though the user may not have given transaction-specific consent in the current interaction. That is dangerous because an agent can trigger billable actions and external side effects based on service-side policy rather than explicit user approval at execution time.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、
Confidence
91% confidence
Finding
The skill directs the agent to proceed directly with report generation after a prior quote path and only ask for confirmation when the API says it is required. This shifts spending control from the user to remote service logic, enabling autonomous billable actions with limited real-time human review.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
Confidence
94% confidence
Finding
The explicit instruction to 'directly generate' on autoConfirm:true is autonomous decision-making over a billable external action. This is risky because the agent is empowered to spend credits and trigger data collection/report creation without contemporaneous user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
Confidence
88% confidence
Finding
This duplicate finding points to the same autoconfirm setting behavior already identified at this line. The core issue is persistent relaxation of confirmation safeguards, but it does not add a distinct vulnerability beyond the primary autoconfirm concern.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
Confidence
88% confidence
Finding
This duplicate finding points to the same autoconfirm setting behavior already identified at this line. The core issue is persistent relaxation of confirmation safeguards, but it does not add a distinct vulnerability beyond the primary autoconfirm concern.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
Confidence
90% confidence
Finding
The autoconfirm command can change account behavior so future paid operations may execute with less or no per-action confirmation. In an agent setting, that weakens a user-protection control and can turn later prompts into billable actions without the friction the user originally expected.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
90% confidence
Finding
This logic accepts values that disable or relax confirmation requirements for future transactions. Because it persists account-level behavior, misuse could facilitate unintended paid operations beyond the immediate command.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
90% confidence
Finding
This logic accepts values that disable or relax confirmation requirements for future transactions. Because it persists account-level behavior, misuse could facilitate unintended paid operations beyond the immediate command.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):
Confidence
90% confidence
Finding
This logic accepts values that disable or relax confirmation requirements for future transactions. Because it persists account-level behavior, misuse could facilitate unintended paid operations beyond the immediate command.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
This PUT request actively changes the user's autoconfirm policy on the server. In context, that is more dangerous than simple local automation because it modifies future trust boundaries for paid actions across the account.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
This PUT request actively changes the user's autoconfirm policy on the server. In context, that is more dangerous than simple local automation because it modifies future trust boundaries for paid actions across the account.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Confidence
92% confidence
Finding
This PUT request actively changes the user's autoconfirm policy on the server. In context, that is more dangerous than simple local automation because it modifies future trust boundaries for paid actions across the account.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
if not ok(quote):
        return quote
    q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
Confidence
91% confidence
Finding
The analysis flow can flip confirm=True automatically when the server says autoConfirm is allowed and balance is sufficient, resulting in a paid analysis without an explicit per-action user confirmation. In an agent context, this erodes the expected approval boundary for billable operations.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
return quote
    q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
        auto_confirmed = True
Confidence
91% confidence
Finding
This line is part of the branch that marks a paid action as auto-confirmed based on backend policy instead of current user intent. That can cause unanticipated charges when a caller expected a quote-only response.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
        auto_confirmed = True
    if not confirm:
Confidence
91% confidence
Finding
Setting auto_confirmed true records that the system proceeded with autonomous spending behavior. The security concern is the underlying state transition to execution without fresh approval.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
if plan is not None and plan["balance"]["note"]:
        combined_quote["siteNote"] = plan["balance"]["note"]
    combined_quote["webUrl"] = analysis_quote.get("webUrl")
    # 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))
Confidence
93% confidence
Finding
The combined VOC workflow can auto-confirm both collection and analysis charges if the backend signals eligibility and the total cost is under a threshold. Because this bundles multiple billable steps, the agent context makes automatic execution more sensitive than in a purely manual CLI.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
combined_quote["webUrl"] = analysis_quote.get("webUrl")
    # 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))
                      and sufficient and total_credits <= auto_max)
    if not args.confirm and not auto_confirmed:
Confidence
93% confidence
Finding
This condition allows automatic paid execution of the VOC pipeline when several backend-derived checks pass. It weakens the boundary between quote and charge, especially for a skill exposed through conversational interfaces where user intent can be ambiguous.

Static analysis

No suspicious patterns detected.