Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because documented previews and unanswered requests can lead to spending account credits without fresh approval.
Prefer a corrected release before enabling paid workflows. If using this version, set the account to ask before every charge, use the dedicated quote command for estimates, and explicitly authorize recurring collection. Do not rely on the README's claim that omitting --confirm always prevents spending.
scripts/ari.pyQuote-only deepdive paths can execute paid analysis
An account with an eligible automatic-confirmation policy can lose credits during a documented preview operation. When the main product is absent, the returned productNote can additionally claim that no charge occurred even though paid analysis was attempted successfully.
scripts/ari.pyVOC reuses analysis-only automatic approval for a larger combined charge
The combined operation can consume more credits than the user's automatic-confirmation limit without returning confirmationRequired. Requoting analysis after collection does not restore the boundary because confirmation is forced to true.
The narrow selling-point description loads a much broader account-management workflow, including instructions to spend credits under provider-defined first-run exemptions and to register competitors for automatic weekly collection. Those specific instructions create authorization risks beyond mere feature mismatch, although other expanded features explicitly require consent.
Although both concern Amazon products and use the ARI tool, the supplied chunk exposes a monitoring lifecycle rather than review-based selling-point extraction. Persistent scheduled watches and associated pricing acceptance are material capabilities not disclosed in the declared purpose. The underlying script is not provided, so the assessment concerns the operations explicitly invoked by these commands.
The declared purpose is review-based selling-point extraction, while the supplied chunk exposes a recurring monitoring workflow with persistent state and price-acceptance parameters. Although both concern Amazon products, these capabilities go beyond supporting implementation details for extracting selling points and are not disclosed in the description. The chunk contains command examples rather than evidence that any commands have actually been executed.
The declared purpose describes review analysis and selling-point extraction, not management of recurring product monitoring. While collecting reviews could support that analysis, configuring ongoing weekly collection and its potential costs is a distinct, undeclared capability. The supplied chunk shows scheduling commands rather than selling-point analysis; the implementation of those commands is not included.
The declared purpose is review-based selling-point extraction, but the supplied chunk exposes a scheduled-watch management workflow instead. Persistent monitoring, watch lifecycle changes, and price acceptance are substantive capabilities not disclosed in the description, rather than mere implementation details of extracting selling points. The underlying script is not provided, so its internal operations and any actual charges cannot be verified.
The supplied command requests a Kitchen-category leaderboard based on negative-review rate. This is materially different from the declared positive-review analysis and ranked selling-point extraction. The implementation of ari.py is not supplied, so additional behavior or side effects cannot be established.
Both commands explicitly use '--stars negative', which targets dissatisfaction rather than the positive purchase motivations described. Negative reviews could support broader product research, but the supplied chunk does not connect them to the declared positive-review workflow. The script implementation is not provided, so no additional behavior is inferred.
The comparison workflow recommends binding a competitor with a command that starts automatic weekly collection, without explicitly requiring separate recurring-collection authorization. Approval for a one-time comparison does not necessarily authorize an ongoing collection relationship or associated future charges.
The supplied commands concern watch-monitoring information, not review analysis or selling-point extraction. These are undeclared capabilities with no demonstrated supporting role in the stated workflow. This assessment is limited to the supplied code chunk.
The supplied commands concern watch management and pricing rather than extracting selling points from positive reviews. These capabilities are not disclosed in the declared purpose, and the chunk does not establish them as supporting steps for review analysis. The underlying ari.py implementation is not provided, so this assessment is limited to the visible CLI invocations and their accompanying comment.
The visible commands concern monitoring an existing watch rather than extracting and ranking selling points from positive reviews. Watch monitoring is not declared in the description, and the supplied chunk does not establish it as a supporting step for the stated review-analysis workflow. The underlying script is not provided, so this assessment is limited to the capabilities exposed by these commands.
The command explicitly selects '--workflow audit --focus full', which indicates a broader audit operation not disclosed in the selling-point extraction description. Amazon product targeting and ARI usage are consistent with the declaration, but the selected workflow is materially different. The supplied chunk does not reveal the audit's internal actions, so no additional data access, modification, or destructive behavior can be established.
The command explicitly requests operations quote --workflow audit --focus full. This targets a quote for a full audit, not the described extraction and ranking of selling points. Quoting can be a supporting implementation detail, but the selected workflow is materially different from the declared purpose. The supplied chunk does not establish that an audit is executed, reviews are accessed, or charges occur.
The declared purpose is extracting marketing selling points from customer reviews, whereas the only supplied command selects an alerts operation. That indicates a different capability rather than an evident implementation detail of review analysis. The implementation of scripts/ari.py is not provided, so the exact alert behavior and any resource access cannot be verified.
The skill explicitly tells the agent to turn an unanswered quote from an earlier conversation into execution later, merely announcing that it will generate the report. Silence is not authorization, and a server auto-confirm exemption can allow this stale intent to consume credits without a current request.
run_analysis changes confirm from false to true when the server returns a truthy autoConfirm value, allowing chargeable analysis without --confirm despite the documented guarantee. This also affects callers such as deepdive that attempt to request quotation-only behavior; bool() additionally accepts nonboolean truthy values.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})