Security audit
Security checks for vulnerabilities and agentic risk
This skill can spend your ARI credits before you approve the price, including through a command documented as a free preview.
Before requesting analysis, set ARI to ask before every charge using autoconfirm off and verify the setting. Use quote for previews; omitting --confirm does not reliably prevent spending. Approve recurring collection separately, and choose manual collection when you want only one run.
scripts/ari.pyQuote-only deepdive can execute paid analysis
A preview can consume account credits and generate an archived report without the command's promised confirmation. When the target is missing and --confirm was supplied, deepdive can additionally report that analysis was downgraded to quotation despite having executed it.
scripts/ari.pyRecurring paid collection changes lack an executable confirmation gate
Calling these helpers can start recurring credit consumption without the required confirmation step. This affects the ARI account's collection settings, not operating-system startup persistence.
Product watches and account-policy changes are openly documented and generally require explicit user authorization, so those extensions are not inherently vulnerabilities. However, a generic review-analysis request can trigger spending under service-defined first-run exemptions without advance price disclosure or demonstrated user spending authorization, creating a material consent gap beyond the description.
run_analysis replaces missing local confirmation with a server-provided autoConfirm value and then invokes a chargeable analysis endpoint. cmd_voc similarly permits both collection and analysis without --confirm, so calls understood as previews can spend credits; deepdive's purported quote-only downgrade can also be bypassed by this behavior.
The referenced policy treats a service-provided autoConfirm flag as sufficient authorization for paid operations. The surrounding changelog describes automatic spending for new users without an amount ceiling, but does not establish that those users explicitly authorized that spending policy; this creates a financial authorization risk rather than evidence of malicious activity.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented workflow automatically collects data and generates a paid report, and the first N paid generations explicitly have no amount ceiling. Gift credits, insufficient-balance checks, and optional user thresholds reduce exposure, but do not establish informed consent to consume credits; displaying charges after execution is not preventive authorization.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This occurrence belongs to the same automatic-spending policy, not a separate vulnerability. Using a structured boolean instead of parsing explanatory text is sound, but relying on that server-controlled boolean alone still leaves user authorization and maximum spending insufficiently established.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This is a duplicate match within the same financial authorization issue. The concern is not the autoConfirm identifier itself, but the documented ability to perform paid operations without a demonstrated user-approved spending ceiling; implementation enforcement cannot be verified from this changelog.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
The same automatic-spending policy is extended to all listed analysis types, allowing generation and charging whenever autoConfirm is true. This broadens the financial authorization issue beyond VOC reports; returning charges afterward provides transparency but does not prevent unauthorized credit consumption.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Without declared permissions the skill's intent is opaque and cannot be validated.
The surrounding rule permits collection, generation, and credit deduction based on server exemptions, including first-run execution without an amount limit. A server eligibility flag is not proof of user consent, although an explicitly user-configured spending threshold could legitimately authorize some executions.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
This occurrence belongs to the same spending-consent flaw as the preceding finding: the automatic-confirmation path can deduct credits before the user sees the cost. Post-execution disclosure of charges improves transparency but does not supply missing advance authorization.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。
The standard workflow explicitly skips a separate quote and acknowledges that the default VOC call may already have deducted credits before returning. This exposes users who requested analysis, but did not approve spending, to unexpected charges; the later instruction to report actual charges does not prevent that outcome.
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
**返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
（1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
**不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**
The instruction treats every server-provided autoConfirm flag as sufficient authority and explicitly includes initial paid runs without an amount ceiling. This conflates provider-configured eligibility with user-granted spending permission and can consume credits without informed approval.
- **价格一律以服务端本次报价为准**（`analysis/quote` 与 `collect` 报价返回的 `credits` /
`totalCredits`）。文档与示例里出现的任何单价、页数、合计都只是演示，后台可调，
**不要凭记忆或旧文档报数，也不要把示例价当成承诺价。**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点（取报价返回的 `credits` / `totalCredits`，
**不要自己算、不要写死单价**）、余额多少，然后等用户一个「好」。单价与页数由后台配置决定，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点（取报价返回的 `credits` / `totalCredits`，
**不要自己算、不要写死单价**）、余额多少，然后等用户一个「好」。单价与页数由后台配置决定，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点（取报价返回的 `credits` / `totalCredits`，
**不要自己算、不要写死单价**）、余额多少，然后等用户一个「好」。单价与页数由后台配置决定，
商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
**不要自己算、不要写死单价**）、余额多少，然后等用户一个「好」。单价与页数由后台配置决定，
商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。
**新手（`check` 返回 `autoConfirm.mode` 为 `first_runs` / `free_small`，或问"然后呢"）**
- 报告讲完只推一个下一步，附接口返回的成本，不写死月费用。用户同意再 `schedule --set weekly`。
- 不解释命令名，不列功能清单。用户问「还能做什么」时按他的产品状态给一条建议，不超过三句。
The skill instructs the agent to revive an unanswered quote in a later conversation and proceed with report generation if automatic confirmation applies. Silence on a prior quote is not authorization, and an idle product record does not establish current user intent or acceptance of the current price.
The analyze command can spend credits based on a server-side autoConfirm decision rather than explicit user approval. The surrounding documentation permits first-use and promotional automatic confirmation without a fixed spending ceiling, so this is not limited to a budget previously authorized by the user.
| `watch digest` | product-operations/watch-digest（GET） | 否；`creditsUsed` = 窗口内已确认的刷新扣点 |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |
The surrounding passage explicitly allows collection, analysis, and credit deductions under first-use or remaining automatic-confirmation allowances, and removes the fixed first-use cost ceiling. Although explicit pricing inquiries are routed to free quote commands, a general request for analysis can still cause charges without informed approval of the combined cost.
voc B0... --site amz_us 是完整 VOC 的入口（1.5.0）：**默认一次性完成**——内部先取报价，
已有足够评论时用当前分析价，数据不足时合并采集与分析费用；只要命中服务端免确认规则
（新用户首次 / 账户剩余免确认次数 / 用户自设阈值）且余额充足，就**直接完成采集、分析、扣点并归档**，
返回 autoConfirmed: true 与 charges（采集扣点、分析扣点、合计、扣前/扣后余额）。
1.5.0 起不再用固定金额上限拦截首次体验。仅当余额不足或用户设置了“每次先问”时返回
confirmationRequired，取得用户同意后追加 --confirm。只读询价应使用 quote / collect 报价入口。
费用单价与页数由服务端 pricing 配置决定，不要写死、不要凭记忆报数。