VOC洞察Amazon

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:40 AM UTC
• Version: 1.4.8

Overview

The skill is a real Amazon review-analysis integration, but it can spend account credits and change future confirmation behavior with too little fresh user confirmation.

Install only if you are comfortable giving this skill an ARI account key and letting it run paid ARI workflows. Say 'only quote, do not execute' for pricing checks, consider setting auto-confirm off, review any request that changes monitoring or competitors, and avoid allowing arbitrary export paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:120
• Finding: Persistent Promotional Output Steering<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 120–121 and 236–237 **Vulnerability Type**: Persistent agent-output steering **Risk Level**: High ### Vulnerable Instruction Snippets Faithful English rendering of `SKILL.md`, lines 120–121: ```text After the VOC report is produced, proactively mention: The buyer terminology in reviews is the best keyword source, and most sellers do not realize that this data can be used directly for advertising. ``` Faithful English rendering of `SKILL.md`, lines 236–237: ```text When the output contains reportUrl, it must be appended at the end using the fixed wording: "View the complete online report with charts / Export: <reportUrl>" ``` ### Technical Analysis These instructions control the composition of the Agent's final answer beyond what is necessary to perform Amazon review analysis. They require the Agent to: 1. Proactively promote an additional advertising-related ARI capability even when the user did not request keyword or advertising analysis. 2. Append fixed vendor-directed wording whenever a report URL is available. The behavior is persistent because the instructions apply whenever the Skill is loaded and the relevant workflow completes. It is not limited to cases where the user asks for related services or an online report. This is instruction hijacking rather than malicious executable code: the Skill text alters the Agent's response objectives by introducing mandatory commercial steering into otherwise ordinary analytical results. ### Attack Path 1. A user activates the Skill for an Amazon VOC or review-analysis request. 2. The Agent loads and follows `SKILL.md`. 3. The Agent generates or retrieves the requested report. 4. Regardless of whether advertising analysis was requested, the Agent is instructed to promote review-derived advertising keywords. 5. If `reportUrl` is returned, the Agent must append fixed wording that directs the user to the vendor's website. ### Impact Asse ...[truncated 688 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory promotional language from the Skill instructions. 2. Do not require the Agent to mention advertising, keywords, subscriptions, monitoring, or other additional products unless they directly address the user's request. 3. Replace fixed link-placement requirements with optional guidance, for example: - Provide the online report link when the user requests it. - Include it when it is necessary to access a generated deliverable. - Clearly identify the link as optional. 4. Separate requested analytical output from optional next steps under an explicitly labeled section. 5. Require the Agent to obtain user interest before suggesting paid or unrelated capabilities. 6. Avoid fixed marketing copy and allow the Agent to use neutral, context-sensitive language. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ari.py:1474
• Finding: User-Controlled Export Path Permits Unrestricted File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py`, lines 1474–1475; data flow from lines 1598–1612 **Vulnerability Type**: Arbitrary overwrite of files writable by the current user **Risk Level**: Medium ### Vulnerable Code Snippet The download sink writes directly to the supplied destination: ```python with open(dest, "wb") as fh: fh.write(body) ``` The destination can originate from the user-controlled `--out` argument: ```python def cmd_export(args): """Export review CSV or report HTML/Markdown to a local file.""" if args.report_id: fmt = args.format or "md" dest = args.out or ("ari_report_%d.%s" % ( args.report_id, "html" if fmt == "html" else "md" )) emit(request_download( "/api/v1/export/reports/%d" % args.report_id, {"format": fmt}, dest ), args.compact) return if not args.asin: emit(error_obj( "ARI_VALIDATION_ERROR", 0, "An ASIN or report ID is required", "Use export --asin <ASIN> for review CSV or " "export --report-id <ID> for a report." ), args.compact) return dest = args.out or ("ari_reviews_%s.csv" % args.asin.upper()) emit(request_download( "/api/v1/export/reviews", {"asin": args.asin.upper(), "site": args.site}, dest ), args.compact) ``` The parser exposes the destination without applying path restrictions: ```python p.add_argument("--out", help="Output file path; an automatic name in the current directory is used by default") ``` ### Technical Analysis `args.out` is passed to `request_download()` as `dest`. The destination is then opened with mode `"wb"`, which truncates an existing file before writing the downloaded content. No protection is applied against: - Absolute paths. - Parent-directory traversal. - Existing destination files. - Symbolic links. - Writes outside a ...[truncated 1814 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store exports in a dedicated directory by default, such as `~/Downloads/ARI/` or an application-specific export directory. 2. Resolve the destination using `pathlib.Path.resolve()` and verify that it remains inside the approved export directory. 3. Reject absolute paths and parent-directory traversal unless the user has explicitly authorized an external destination. 4. Refuse to overwrite an existing file by default. Require a separate explicit `--overwrite` option. 5. Create files atomically and exclusively. On supported platforms, use flags such as: ```python flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL if hasattr(os, "O_NOFOLLOW"): flags |= os.O_NOFOLLOW fd = os.open(destination, flags, 0o600) ``` 6. Reject symbolic-link destinations and validate the destination immediately before opening it. 7. Write to a temporary file in the destination directory, validate the completed response, and atomically rename it into place. 8. Apply restrictive permissions to exported files when they may contain customer reviews or business analysis. 9. Present the resolved destination to the user before writing when the path was generated from untrusted or Agent-provided input. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()

• Confidence: 83% confidence
• Finding: The export/download path sends an Authorization bearer token to whatever host base_url() resolves to, and base_url() can be redirected by environment variables when ARI_ALLOW_CUSTOM_BASE=1 is set. In an agent or shell-integrated environment, a poisoned environment or startup wrapper could cause credential-bearing requests and downloaded data to be sent to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions while instructing the agent to use shell execution, network access, local file writes, and environment/API-key handling. This creates a capability-transparency gap: users and the platform may not realize the skill can authenticate, store secrets locally, export files, and invoke external services, which increases the chance of unsafe execution and weak review controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The published description frames the skill as Amazon review/VOC analysis, but the instructions extend into authentication, local secret storage, billing preference changes, paid actions, monitoring management, competitor binding, exports, and broader operational workflows. That mismatch is dangerous because users may consent to a narrow analytics tool while the agent is empowered to make account-affecting changes, incur charges, and persist data beyond the expected scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 96% confidence
• Finding: This instruction allows paid report generation to proceed automatically when the backend marks it auto-confirmed, explicitly telling the agent not to ask the user again. Even if the server permits it, this is still an autonomous spend path that can charge the user's account without contemporaneous consent in the session, which is especially risky in an agentic environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 94% confidence
• Finding: The skill directs the agent to proceed from quote to a chargeable `--confirm` execution after minimal confirmation handling, while also automatically waiting for collection and report generation. In practice this bundles multiple potentially billable or state-changing steps into one agent action, increasing the risk of unintended spend or overbroad execution from ambiguous user consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 97% confidence
• Finding: This line explicitly instructs the agent to directly generate chargeable outputs whenever `autoConfirm: true` is returned, without asking the user. That is autonomous financial decision-making and weakens user control over paid actions, particularly because the skill also emphasizes not surfacing technical details or command logs.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 95% confidence
• Finding: The same instruction also supports `autoconfirm off/default`, demonstrating that the skill can mutate persistent account authorization behavior from chat. Persistent consent-state changes are dangerous because they affect future spending decisions outside the immediate task and may not be obvious to the user later.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 95% confidence
• Finding: The same instruction also supports `autoconfirm off/default`, demonstrating that the skill can mutate persistent account authorization behavior from chat. Persistent consent-state changes are dangerous because they affect future spending decisions outside the immediate task and may not be obvious to the user later.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch delete` | product-operations/watches/{id}（DELETE） | 否；不删除商品资料、评论或历史报告 |
| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |

• Confidence: 90% confidence
• Finding: The reference explicitly states that `analyze` may execute and incur charges when server-side `autoConfirm` rules are met, without requiring an explicit per-action user confirmation. In an agent setting, this creates a real risk of autonomous paid actions and unintended external processing of user data, especially if the agent interprets a general request as authorization to proceed.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: This finding is distinct because the same line documents a persistent control over confirmation behavior, not just a one-time action. A skill exposing this capability can reduce friction for future paid operations and effectively bypass the expectation of fresh consent for each billable request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 95% confidence
• Finding: This finding is distinct because the same line documents a persistent control over confirmation behavior, not just a one-time action. A skill exposing this capability can reduce friction for future paid operations and effectively bypass the expectation of fresh consent for each billable request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 92% confidence
• Finding: The VOC workflow states that when server-side no-confirmation rules match, it may directly generate a report and automatically perform the necessary collection, waiting, analysis, and archiving. Because this can combine data collection with billable analysis without an explicit confirmation step, it is a genuine autonomous-action risk in an agent environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 90% confidence
• Finding: The quote response includes `autoConfirm` metadata indicating that immediate generation may be allowed without another consent step. Exposing this as an acceptable execution path encourages the agent to treat pricing metadata as authorization, which is unsafe when actions are billable or process external data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 90% confidence
• Finding: The duplicate finding still points to a meaningful issue: auto-confirmed execution couples pricing lookup and analysis execution too closely in an agent context. This increases the chance that a user asking for information or a quote gets an actual paid report generated instead.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 90% confidence
• Finding: The duplicate finding still points to a meaningful issue: auto-confirmed execution couples pricing lookup and analysis execution too closely in an agent context. This increases the chance that a user asking for information or a quote gets an actual paid report generated instead.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 88% confidence
• Finding: The presence of `autoConfirmNote` and related fields normalizes the notion that no-click execution is expected for some billable analyses. In a human-operated CLI this may be acceptable, but in an AI agent skill it materially increases the risk of unauthorized charges and unintended processing because the agent can mistake capability for consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 90% confidence
• Finding: The skill context makes this more dangerous than a normal CLI reference because an LLM agent may autonomously choose between quote and execution paths. Since the file explicitly permits auto-confirmed billable analysis, the agent could create reports and spend credits based on ambiguous user prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 90% confidence
• Finding: The skill context makes this more dangerous than a normal CLI reference because an LLM agent may autonomously choose between quote and execution paths. Since the file explicitly permits auto-confirmed billable analysis, the agent could create reports and spend credits based on ambiguous user prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

- `voc`: Markdown VOC 报告，SSE 聚合后在 `data.content`，并归档。

• Confidence: 90% confidence
• Finding: The skill context makes this more dangerous than a normal CLI reference because an LLM agent may autonomously choose between quote and execution paths. Since the file explicitly permits auto-confirmed billable analysis, the agent could create reports and spend credits based on ambiguous user prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:

• Confidence: 90% confidence
• Finding: The skill exposes a command to change auto-confirm thresholds for paid operations, allowing future spending without per-action confirmation. In an agent setting, this weakens user consent boundaries and can enable silent or less-visible credit consumption if invoked by a prompt-influenced workflow.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This command path accepts values that disable prompts for paid actions ('off'/'ask'/'0' or numeric thresholds) and persists them server-side. In a conversational agent environment, modifying consent policy through normal command flow can lead to unintended financial actions beyond the user's immediate request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This command path accepts values that disable prompts for paid actions ('off'/'ask'/'0' or numeric thresholds) and persists them server-side. In a conversational agent environment, modifying consent policy through normal command flow can lead to unintended financial actions beyond the user's immediate request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:
        if value in ("off", "ask", "0"):

• Confidence: 90% confidence
• Finding: This command path accepts values that disable prompts for paid actions ('off'/'ask'/'0' or numeric thresholds) and persists them server-side. In a conversational agent environment, modifying consent policy through normal command flow can lead to unintended financial actions beyond the user's immediate request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

• Confidence: 90% confidence
• Finding: The PUT to /api/v1/user/autoconfirm persists autonomous spending behavior, which is more sensitive than ordinary account preferences. If triggered indirectly, it can reduce friction for subsequent paid operations and create billing surprises.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

• Confidence: 90% confidence
• Finding: The PUT to /api/v1/user/autoconfirm persists autonomous spending behavior, which is more sensitive than ordinary account preferences. If triggered indirectly, it can reduce friction for subsequent paid operations and create billing surprises.

Static analysis

No suspicious patterns detected.