Amazon ASIN 周报简报

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:39 AM UTC
• Version: 1.4.8

Overview

The skill appears to connect to the intended ARI service, but it gives the agent broader billing, monitoring, export, and account-setting authority than the weekly-report name suggests.

Review this before installing if you only wanted a narrow weekly ASIN report. Install only if you are comfortable giving the agent access to your ARI account, saved API key, paid analysis flows, local exports, recurring monitoring settings, competitor tracking, and confirmation-policy changes. Prefer keeping autoconfirm off or low, say 'only quote, do not execute' when checking prices, and do not set ARI_ALLOW_CUSTOM_BASE unless you intentionally use a trusted non-official ARI endpoint.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()

• Confidence: 72% confidence
• Finding: Authenticated export downloads send the Bearer API key to a base URL that can be redirected via environment variables when ARI_ALLOW_CUSTOM_BASE=1 is present. In an agent or shell-integrated environment, a malicious or inherited environment can cause sensitive credentials and downloaded data to be sent to an attacker-controlled host, and this skill handles exports of reports/reviews that may contain commercially sensitive information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs use of shell, network, environment-variable, and file-write capabilities via `python scripts/ari.py` commands, API key setup/configuration, and local key storage, but does not declare permissions. That creates a trust-boundary problem: a host may grant broader execution than users expect, enabling networked actions and local state changes without transparent capability disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The metadata claims a narrow purpose—confirmed, paid weekly reports for a single subscribed ASIN—but the body documents many additional capabilities: account setup, review collection, monitoring, competitor management, exports, watch management, and multiple paid analyses. This mismatch can mislead users and policy enforcement, causing execution of broader, potentially billable or privacy-impacting operations outside the declared scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata says it is only for generating a weekly report for a single subscribed ASIN after explicit confirmation, but the file implements a broad multi-function CLI including collection, scheduling, watches, alerts, competitor tracking, exports, account configuration, and operational tooling. This scope expansion is dangerous in an agent setting because callers may invoke unrelated state-changing or billable actions that exceed the user's expected consent and the skill's declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Competitor management, radar, benchmark, leaderboard, and compare-analysis features go beyond the declared single-ASIN weekly brief purpose and introduce extra paid queries and broader market surveillance behaviors. In context, this mismatch increases the chance of unauthorized account activity, unintended billing, and access to data the user did not intend this skill to process.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Workbench/advice/export/report-management functionality is unrelated to generating a weekly ASIN brief and materially broadens the actions available to the agent, including local file writes and paid AI advice generation. This is a least-privilege violation relative to the skill description and can lead to unintended side effects on the local system and remote account.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill claims weekly-only usage, yet the watch creation command supports daily scheduling. Daily monitoring materially increases collection frequency, possible billing, and behavioral scope, making the skill more invasive than advertised.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: cmd_autoconfirm modifies the remote account's billing/confirmation policy, which is unrelated to generating a weekly brief and weakens future user consent protections. An agent invoking this can silently change how later paid operations behave across the account, creating durable side effects beyond a single report run.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill metadata says this skill is only for a weekly report on a single subscribed ASIN after explicit quote confirmation, but the guide documents a much broader toolset including monitoring, exports, alerts, competitor workflows, and other analysis modes. This creates a scope mismatch that can cause an agent or user to invoke capabilities outside the declared trust boundary, increasing the risk of unauthorized actions, billing, or data access.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented examples include competitor comparison and other non-weekly, multi-ASIN analysis flows even though the skill is described as a narrowly scoped weekly single-ASIN briefing tool. In an agent setting, such examples effectively expand the allowed command surface and may lead the model to perform actions the user and platform did not authorize for this skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The guide documents scheduled monitoring and watch features despite the manifest explicitly saying the skill is not for free monitoring summaries or hourly/real-time monitoring. This inconsistency can mislead an agent into enabling recurring collection or monitoring-related operations that exceed user expectations and the declared product boundary, with possible ongoing cost or surveillance implications.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes alerts, workbench actions, benchmarks, leaderboard queries, competitor binding, radar, exports, and report history even though these are outside the manifest's narrowly declared weekly-report purpose. While not all of these are inherently dangerous, bundling them into this skill broadens the accessible functionality and raises the chance of unintended data access, exports, or billable operations through a misleadingly scoped interface.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 95% confidence
• Finding: This instruction permits paid report generation when the backend returns `autoConfirmed: true`, meaning the skill may trigger billable actions without obtaining fresh, explicit approval in the current interaction. In an agent setting, that weakens transactional consent and can lead to unauthorized charges or actions based only on server-side heuristics or prior defaults.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 95% confidence
• Finding: The documented flow has the agent default to executing `voc <ASIN>` before determining whether confirmation is required, and the prior line states that this may directly generate and charge. That creates a clear risk of autonomous billable behavior before informed user consent is captured in-session.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 94% confidence
• Finding: The skill explicitly tells the agent to proceed with generation when `autoConfirm: true` and not ask the user again. In the context of paid analysis and external API actions, this delegates spending authority to backend policy rather than the user's immediate consent, which is unsafe for an autonomous agent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 92% confidence
• Finding: The same line also allows disabling confirmations (`autoconfirm off/default/50`) through agent-mediated commands, which is a persistent authorization-policy mutation. Persistent consent settings should not be changed casually by an LLM because they affect future transactions beyond the current task.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 92% confidence
• Finding: The same line also allows disabling confirmations (`autoconfirm off/default/50`) through agent-mediated commands, which is a persistent authorization-policy mutation. Persistent consent settings should not be changed casually by an LLM because they affect future transactions beyond the current task.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch delete` | product-operations/watches/{id}（DELETE） | 否；不删除商品资料、评论或历史报告 |
| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |

• Confidence: 85% confidence
• Finding: The reference explicitly allows paid `analyze` operations to run when server-side `autoConfirm` rules are met, meaning the agent may trigger billable actions without fresh, explicit user confirmation. In an agent setting, this weakens the human-in-the-loop safeguard and can lead to unauthorized spending or unintended data processing if the user only expected a quote or read-only action.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same persistent `autoconfirm` capability, which can lower safeguards for future paid operations beyond the current task. Because it affects ongoing account behavior rather than one isolated request, misuse could cause repeated unauthorized charges or autonomous executions later.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `watch digest` | product-operations/watch-digest（GET） | 否；确定性摘要，`creditsUsed: 0` |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
| `alerts` | alerts（`--mark-read` 时 alerts/read） | 否 |

• Confidence: 92% confidence
• Finding: This duplicate finding points to the same persistent `autoconfirm` capability, which can lower safeguards for future paid operations beyond the current task. Because it affects ongoing account behavior rather than one isolated request, misuse could cause repeated unauthorized charges or autonomous executions later.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 90% confidence
• Finding: This section states that `voc` may directly generate a paid report when server-side auto-confirm conditions are satisfied, instead of always requiring an explicit confirmation step in the current interaction. For an agent skill handling billing-sensitive operations, this creates a real risk of unintended charges and collection/analysis activity when the user may only have intended to ask for pricing or review options.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 88% confidence
• Finding: The quote response includes `autoConfirm` metadata indicating whether the service will permit immediate execution, which can tempt downstream logic to treat quoting as implicit authorization. In an agent environment, surfacing this as an execution signal without a separate human approval check can convert a pricing lookup into an unintended paid action.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 90% confidence
• Finding: This duplicate finding refers to the same `autoConfirmed: true` execution path. The core issue is still that paid analysis can proceed based on backend policy rather than fresh user approval in the active conversation, which is an unsafe autonomy pattern for a billing-capable skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 90% confidence
• Finding: This duplicate finding refers to the same `autoConfirmed: true` execution path. The core issue is still that paid analysis can proceed based on backend policy rather than fresh user approval in the active conversation, which is an unsafe autonomy pattern for a billing-capable skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}


def cmd_autoconfirm(args):
    """免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
    value = (args.value or "").strip().lower()
    if value:

• Confidence: 95% confidence
• Finding: This command lets the skill change the account's autoconfirm threshold, altering how future paid operations are authorized. In an agent context, changing a persistent consent/billing setting is more dangerous than a one-off action because it can enable subsequent charges without the user's explicit per-action approval.

Static analysis

No suspicious patterns detected.