Security audit
Security checks for vulnerabilities and agentic risk
This weekly-report skill exposes broader monitoring controls and can spend account credits without fresh approval.
Prefer a corrected package that enforces weekly-only commands and explicit approval. Until then, restrict use to operations quote/run, configure ARI to ask before every charge, and review recurring collection settings. The scanner's broad warnings were narrowed using package evidence; the concrete spending and scope conflicts justify Review.
scripts/ari.pyAnalysis-only auto-confirm authorization is extended to collection and analysis
Account credits can be consumed beyond the user's configured per-operation auto-confirm threshold without obtaining approval for the total.
scripts/ari.pyDeepdive's quote-only path can silently become paid analysis
A user or Agent following the documented preview workflow can incur unexpected analysis charges. Even the explicit missing-subscription downgrade does not prevent execution.
The commands target the scheduler through schedule, schedule --set weekly, and schedule --set manual. These are operational controls for monitoring and recurring collection, not merely supporting steps shown for generating a requested report. In particular, enabling weekly automatic collection materially exceeds the declared restriction to actively triggered weekly AI reports. The supplied chunk does not show report generation or confirmation and quotation checks; behavior inside the referenced Python script cannot be verified from this chunk.
The supplied command targets a category leaderboard rather than the declared single-ASIN weekly reporting workflow. Although --confirm is present, it does not establish that the required user confirmation and quotation process occurred. The mismatch is the leaderboard operation itself, not supporting implementation details. The snippet does not establish what neg_rate measures or whether an API key is configured.
The commands primarily concern monitoring-watch lifecycle management and monitoring-data retrieval, which materially exceed the narrowly declared report-generation purpose. The digest command also overlaps a category explicitly excluded by the description, although the snippet does not establish whether that digest is free. The price-acceptance flags are consistent with paid confirmation, but do not resolve the broader capability mismatch. The snippet does not demonstrate AI report generation or the use of product details and review evidence.
The body repeatedly directs paid VOC execution without prior pricing acceptance, contradicting the advertised quote-and-confirm contract. The closing weekly-only restriction mitigates this but leaves conflicting executable instructions that could cause unexpected credit consumption; implementation-level claims about selectable workflows cannot be verified from this file alone.
The commands center on watch-monitoring outputs, particularly watch digest, which conflicts with the description's explicit exclusion of monitoring summaries. A seven-day digest is not by itself the declared weekly AI report. Historical series could support reporting, but the supplied chunk shows only monitoring retrieval and no connection to the promised report-generation workflow. Whether confirmation, quotation, or API-key enforcement occurs elsewhere cannot be determined from this chunk.
The command explicitly selects --type compare and supplies --competitor B0BBBBBBBB, indicating a competitor-comparison workflow not disclosed by the narrowly scoped weekly-report description. The snippet does not establish whether confirmation, quotation, subscription, or API-key checks occur inside the script, so those are not treated as additional mismatches.
The comparison workflow says binding a competitor starts weekly automatic collection without explicitly requiring separate acceptance of that recurring collection and its costs. Consent to a one-time comparison does not necessarily authorize continuing collection; broader authorization language elsewhere reduces but does not eliminate this ambiguity.
The visible commands expose watch management rather than report generation. Creating scheduled watches and managing their lifecycle are material capabilities not disclosed by the narrowly stated report-generation purpose. The competitor option also expands the scope beyond a single subscribed ASIN. Weekly scheduling and price acceptance align with parts of the description, but do not resolve these differences. The underlying script is not supplied, so its API access and report contents cannot be verified.
Pricing quotes and acceptance parameters are consistent with the declared payment workflow, but the broader watch-management and monitoring-retrieval interface materially exceeds the stated report-only purpose. In particular, scheduled watches, competitor tracking, events, and historical series are not merely implementation details of generating one requested weekly report. The underlying Python implementation is not supplied, so the snippet does not establish real-time access, free access, or specific data returned by these commands.
命令明确使用 compare 类型和 --competitor 参数，体现的是双 ASIN 竞品比较，而非声明的单个 ASIN 周报。--confirm 与确认流程可能相关，但不会消除分析类型和对象范围的差异。片段未展示脚本内部实现，因此无法判断是否还涉及报价校验、订阅校验或其他数据访问。
The command's selected operation, alerts, is inconsistent with the narrowly declared weekly-report purpose. However, the implementation of scripts/ari.py is not supplied, so the exact alert behavior, resources accessed, and any confirmation or quotation checks cannot be verified.
The supplied usage command selects a benchmarking operation, which is not described in the declared purpose. Nothing in the supplied chunk connects that operation to weekly-report generation. This assessment is limited to the visible command: it does not establish what data the benchmark accesses or whether confirmation, quotation, subscription, or API-key checks occur internally.
These instructions allow collection, report generation, and credit deduction before presenting a price whenever the server supplies an automatic-confirmation flag. First-run eligibility is not evidence of user-approved spending, and this conflicts directly with the skill's explicit confirmation requirement.
The skill directs the agent to revive an unanswered quote in a later conversation and proceed with generation if automatic confirmation applies. An idle product or prior inquiry is not present authorization, so this can spend credits without a current request or accepted price.
run_analysis converts an absent --confirm into authorization when the server returns a truthy autoConfirm value; cmd_voc similarly permits collection and analysis without explicit confirmation. This contradicts the specialized skill's express-consent contract and can spend account credits on a call expected to return only a quote, although reachability of these commands depends on the unavailable allowedCommands configuration.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
只保留用户自设阈值与余额校验。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true`、
`charges`（collectionCredits / analysisCredits / totalCredits / balanceBefore / balanceAfter）与 `autoConfirmNote`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
p = sub.add_parser("version", parents=[common], help="显示 Skill 版本与渠道（无需 Key）")
p.set_defaults(fn=cmd_version)
Without declared permissions the skill's intent is opaque and cannot be validated.