亚马逊变体分析 · 颜色尺寸口碑对比

• Outcome: Review
• Latest audit: Oct 27, 2026 · 8:31 AM UTC
• Version: 1.5.3

Overview

Review recommended because this skill can spend credits without fresh approval and incorrectly describe paid analysis as quote-only.

Before use, configure and verify confirmation before every charge. Use quote for estimates and --schedule manual for one-time collection; omitting --confirm does not reliably prevent spending. Require renewed approval for unanswered quotes and separate consent for recurring costs. Prefer a corrected version with reliable quote-only behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ari.py

Finding

Quote-only deepdive can silently escalate to paid analysis

Content

View full analysis

Impact

The command can generate and charge for a report without the explicit confirmation promised for deepdive. The same escalation defeats its missing-main-product fallback: target=None sets confirm=False, but the shared helper can re-enable execution. The command may then state that analysis was reduced to quotation and no credits were deducted.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (93)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied commands primarily implement recurring ASIN monitoring and its lifecycle, including price-accepted creation and resumption. These are material capabilities not disclosed by the variant-analysis description. The chunk contains no explicit parent-child variant comparison or color, size, or specification review analysis. Although monitoring data could support broader product analysis, managing recurring watches is not merely an implementation detail of the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Most additional workflows are merely broader than the description, but the skill also directs paid generation under service-defined default exemptions and proactive generation after an unanswered quote. These instructions can turn a narrowly scoped analysis interaction into credit-consuming activity without informed spending authorization; the supplied text does not independently establish every account mutation alleged by the scanner.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose covers variant comparison and analysis, but does not disclose configuring recurring monitoring or potentially billable collection. These are consequential operational capabilities rather than merely supporting analysis details. The snippet also includes a command to return collection to manual mode, so it does not establish that weekly monitoring remains enabled after all commands execute.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose concerns comparing sibling variants, but the supplied chunk exposes an ongoing monitoring workflow without parent-child variant comparison or review-difference analysis. Scheduled watches, competitor tracking, and price acceptance are material capabilities not disclosed in the description, rather than merely supporting implementation details. The chunk contains command examples rather than the underlying implementation, so it does not establish whether these actions were executed or charges incurred.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied commands manage persistent, scheduled monitoring rather than compare sibling variants or analyze their review differences. Recurring watch lifecycle management, competitor monitoring, and price acceptance are material capabilities not disclosed in the declared variant-analysis purpose. The underlying script is not supplied, so this assessment concerns the operations explicitly invoked by the shown commands.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The competitor-binding instruction states that binding starts weekly automatic collection but does not locally require a recurring-cost quote or separate consent. Although general scheduling rules require authorization, this shortcut creates ambiguity that could let approval for a one-time comparison be misapplied to ongoing collection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The demonstrated commands concern watch monitoring and its costs, neither of which is declared in the variant-analysis description or shown to support that workflow. This is an assessment of the supplied command invocations; the underlying ari.py implementation is not provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied command targets a product category and a negative-review-rate ranking metric. It supplies no parent ASIN, child ASINs, or variant comparison parameters. Its visible operation therefore differs materially from the declared parent-child variant analysis purpose. The underlying script is not supplied, so no additional behavior or side effects are inferred.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied command uses analyze --type compare with --asin and --competitor, indicating competitive product comparison. It does not request parent-child variant analysis or establish that the ASINs belong to the same parent. This differs materially from the declared variant-analysis purpose. The underlying script is not supplied, so no additional behavior can be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied commands concern watch or monitoring functionality, including watchEnabled, perRefresh, and monthlyEstimate information. The description does not declare watch management or monitoring-cost inspection, and the snippet shows no variant comparison or parent-child ASIN analysis. Although both may use ARI, that shared dependency does not establish these commands as supporting the declared analysis. The underlying script is not supplied, so this assessment is limited to the visible command invocations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied commands expose watch-monitoring functionality rather than parent-child ASIN or variant comparison. They contain no visible variant selection, review comparison, or identification of strong and weak variants. Although monitoring data could potentially support variant analysis, the supplied chunk does not establish that connection. This assessment is limited to the visible commands; the implementation of scripts/ari.py is not provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The supplied command uses analyze --type compare with --asin and --competitor, indicating product-versus-competitor comparison. It does not establish that the ASINs share a parent listing or request variant-specific analysis. This materially differs from the declared focus on within-parent variant differences. The underlying script is not supplied, so the assessment is limited to the visible invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

Requesting a quote could be a supporting implementation step, but the selected workflow and scope are explicitly a full audit, not the declared parent-child variant analysis. The supplied chunk contains no variant selection or comparison. The underlying script is not provided, so this assessment is limited to the visible command and does not assume additional behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence

Finding

The supplied command targets alerts, while the description promises parent-child ASIN and color/size variant comparisons. No connection between alerts and that analysis is shown. Because the implementation of scripts/ari.py is absent, the command's precise effects, resource access, and any supporting role cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 79% confidence

Finding

The declared purpose is narrowly focused on parent-child variant analysis, whereas the supplied command explicitly selects '--workflow audit --focus full'. This indicates a broader audit operation rather than the advertised variant comparison. The underlying script is not supplied, so the exact audit contents and any additional effects cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence

Finding

The supplied command targets one review and invokes an advice workflow; it does not visibly compare variants or identify weak and strong child products. This differs from the declared analytical purpose. The CLI implementation is not provided, so the precise effect of --confirm, including whether it changes any external state, cannot be established.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence

Finding

The only supplied operation selects the benchmark subcommand, which does not match the declared variant-analysis workflow. No parent-child grouping or comparison across variants is shown. This assessment is limited to the visible invocation: without the implementation of ari.py, the benchmark's exact behavior and resource access cannot be verified.

Content

No source excerpt is available for this finding.

Treats an unanswered quote as permission to generate a paid report in a later conversation.

High

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to revisit an unanswered quote in a later conversation and proceed with report generation when the service permits automatic confirmation. Silence and an idle product record do not establish current purchase intent, so this can consume credits without authorization.

Content

No source excerpt is available for this finding.

Paid analysis can execute without --confirm, contradicting the module's explicit-confirmation guarantee.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

run_analysis promotes an unconfirmed invocation to a paid execution when the server returns sufficient funds and a truthy autoConfirm value. This contradicts the explicit-confirmation guarantee and can consume credits during analyze or deepdive calls expected to return only a quote; the client does not establish prior user consent or enforce a local spending cap.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The changelog describes treating the server's autoConfirm flag as sufficient authorization to perform chargeable operations without asking the user. The surrounding release notes indicate that this can be a default onboarding policy rather than an explicit user-approved spending delegation; respecting user overrides reduces risk but does not establish consent by default.

Content

Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.

md

- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
  1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
  非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The documented policy allows the first N paid generations without an amount ceiling, based on a server-controlled flag. A request for analysis can therefore trigger collection and credit deductions without advance cost approval; reporting charges afterward and checking available balance do not prevent unwanted spending.

Content

Scanner excerpt · CHANGELOG.md (reported line 32)May include surrounding context.

md

- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
  `voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
  不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This occurrence belongs to the same automatic-spending policy, not a separate exploit. Using a typed boolean instead of interpreting explanatory text is sound parsing practice, but the surrounding policy still substitutes server eligibility for explicit user authorization to spend credits.

Content

Scanner excerpt · CHANGELOG.md (reported line 34)May include surrounding context.

md

不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This duplicates the same line and underlying authorization concern as the other finding at line 34. The risk comes from executing paid work under a default server policy without demonstrated user opt-in, not from the mere presence of an autoConfirm-related field.

Content

Scanner excerpt · CHANGELOG.md (reported line 34)May include surrounding context.

md

不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The release notes extend immediate chargeable execution to variant analysis, making the spending-authorization concern directly relevant to this skill's advertised purpose. Returning charges after generation provides transparency but cannot substitute for prior approval or an explicit spending delegation.

Content

Scanner excerpt · CHANGELOG.md (reported line 41)May include surrounding context.

md

为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
  `autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
  一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 77)May include surrounding context.

md

- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`