Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because previews can spend account credits, and automatic spending can exceed the user's chosen limit.
Prefer a release that fixes these spending checks. Before use, select 'ask every time' in ARI and use dedicated quote commands for previews; omitting --confirm is not a reliable safeguard. Confirm collection and analysis costs together, and check recurring schedules after adding products or competitors.
scripts/ari.pyQuote-only deepdive can execute paid analysis
Users or Agents relying on the documented preview behavior can consume account credits without approving analysis for that invocation. The missing-subscription branch can also claim that execution was downgraded to a quote even after the helper has performed paid analysis.
scripts/ari.pyVOC applies analysis-only automatic approval to combined spending
Collection and analysis can consume more credits than the user's automatic-spending limit without obtaining confirmation for the combined charge.
The broader functionality alone is not a vulnerability, and several workflows explicitly require consent. However, this aggregate finding includes concrete authorization gaps: default first-run spending without a user-set limit and competitor binding that starts weekly collection without a separate recurring-charge confirmation.
The declared purpose is review-based buyer-persona analysis, but the supplied commands expose a recurring monitoring workflow and associated pricing acceptance. These are substantive capabilities not disclosed in the description, rather than merely supporting implementation details. The snippet does not show review analysis or persona generation; the underlying implementation and exact monitored data are not provided.
声明聚焦于评论分析和买家画像生成，而所提供的命令仅涉及持续监控任务的生命周期管理，并包含刷新价格接受参数。这些是未声明的独立能力，不能仅视为画像分析的支持性实现细节。片段没有展示评论分析或画像生成，也不足以证明实际发生了扣费。
The comparison workflow says binding a competitor starts weekly automatic collection, but does not explicitly require consent to that recurring plan or its cost. Authorization for a one-time comparison does not authorize ongoing collection, creating a potential path to persistent unwanted activity and credit consumption.
The declared purpose is review-based buyer-persona analysis, but the supplied commands expose a recurring monitoring workflow, including competitor tracking and price acceptance. These are materially broader capabilities than supporting steps for the stated analysis and are not disclosed in the description. The chunk contains no review-analysis or persona-generation operation. Because this is a reference command listing, it demonstrates the exposed workflow rather than proving that any command has been executed.
Review collection could support buyer-persona analysis, but configuring ongoing monitoring and potentially billable weekly collection is a distinct operational capability not disclosed in the description. The supplied commands manage collection schedules rather than analyze reviews or produce personas. The script implementation is not provided, so this assessment is limited to the exposed commands and their stated effects.
The supplied command requests a category leaderboard, not an analysis of who buys a product or their motivations and preferences. This is a materially different analytical operation from the declared purpose. The implementation of ari.py is not supplied, so additional behavior or side effects cannot be established.
The supplied command explicitly selects '--type compare' and identifies a competitor product. This indicates a competitive-comparison workflow, which is materially different from reconstructing customer profiles from reviews. Although prior alternatives are part of the declared persona analysis, the visible command does not request personas or audience insights. The script implementation is not supplied, so the assessment is limited to the invoked operation; no additional resource access or side effects can be established.
The visible commands operate on watch monitoring data rather than reviews or buyer-persona outputs. Although they use the declared ARI tooling, nothing in the supplied chunk connects these monitoring operations to the advertised persona-analysis workflow. This indicates an undeclared capability mismatch. The underlying CLI implementation was not supplied, so its internal behavior cannot be assessed.
The supplied commands concern watch-service costs and watch listings, rather than review analysis or buyer-persona generation. Although they use the ARI CLI, the chunk does not establish that these watch operations support the declared analysis workflow. The assessment is limited to the supplied commands; the implementation of ari.py is not shown.
The supplied commands concern watch management and monitoring costs, not extracting buyer personas from reviews. These capabilities are not described in the declared purpose, and the chunk provides no connection showing that they support persona analysis. The underlying script is not supplied, so this assessment is limited to the visible commands and their annotation.
The supplied command selects '--type compare' and supplies '--competitor', indicating a competitive product analysis workflow. Although the description includes understanding which alternatives buyers switched from, it does not declare a general competitor-comparison capability. No persona-specific analysis is evident in this invocation. The underlying script is not provided, so its internal behavior and any additional resource access cannot be verified.
The command targets alerts, which is materially different from the declared review-based audience analysis workflow and is not explained as a supporting step. The implementation of ari.py is not supplied, so the exact alert behavior, resource access, and side effects cannot be verified.
The explicit command selects operations quote --workflow audit --focus full, which targets a general audit quotation rather than the described persona-analysis task. The Amazon ASIN and marketplace are consistent with the declared domain, but the selected operation and workflow differ materially. The script implementation is not supplied, so no additional behavior or resource access can be established.
Using ARI and an Amazon ASIN is consistent with the description, but the selected full-audit workflow is broader than the declared review-based buyer-persona purpose. The snippet does not show persona extraction or a persona-specific focus. Because the implementation of scripts/ari.py is not supplied, the audit's exact scope and any additional effects cannot be verified.
The supplied command requests benchmarking rather than explicitly requesting review-based buyer-persona analysis. This appears to be a purpose mismatch. Confidence is limited because the implementation of the benchmark subcommand is not supplied; it could include persona analysis, but that cannot be verified from this chunk.
run_analysis changes an absent confirmation into authorization when the server returns a truthy autoConfirm value, contradicting the documented explicit --confirm requirement. cmd_voc similarly allows collection and analysis without that flag, potentially spending credits when an agent expects only a preview; collection authorization is also inferred from an analysis-only policy.
This entry endorses bypassing payment confirmation based solely on a server-provided autoConfirm flag. The surrounding release notes describe automatic paid execution for new users without an amount ceiling, creating a documented authorization weakness: service policy can substitute for informed user approval and consume account credits. This is relevant to a paid analytics skill, although this changelog alone cannot establish whether the affected commands are reachable in this particular package.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented workflow automatically collects data, generates a report, and deducts credits, with the server's first-N policy explicitly ignoring amount ceilings. A request for analysis does not necessarily authorize undisclosed spending, and showing charges afterward does not provide prior approval. User-configured overrides and balance checks reduce exposure but do not establish consent for users who have not configured them.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This entry extends the same server-controlled confirmation bypass to multiple paid analysis types, directing immediate generation when autoConfirm is true. If available in the installed package, these paths could consume credits without a user-approved quote or spending ceiling; returning charges afterward does not prevent that impact. This is an extension of the same underlying authorization issue, not a separate exploit mechanism.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
Automatic spending within an explicit user-set limit can be legitimate, but this rule also accepts first-run exemptions regardless of amount. A server-selected exemption is not evidence of informed user spending authorization, and explaining charges afterward cannot substitute for it.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
No suspicious patterns detected.