Security audit
Security checks for vulnerabilities and agentic risk
This weekly-report skill also exposes broader paid and recurring actions with inconsistent approval controls, creating a risk of unexpected charges.
Prefer a package restricted to confirmed weekly reports. If using this version, enable account-level confirmation for every charge, approve recurring collection separately, and check existing schedules. An unanswered quote should never authorize a later purchase.
scripts/ari.pyRecurring paid collection can be enabled without an enforced confirmation gate
A premature Agent invocation can enable ongoing collection and consume account credits on subsequent scheduled runs. The pricing request and cost explanation occur only after the schedule has already been changed.
The supplied command explicitly requests a Kitchen-category leaderboard and provides no ASIN or weekly-report operation. Although negative-review signals are related to the declared reporting domain, category-wide ranking is a materially different capability and scope from a single-ASIN weekly brief. The --confirm flag does not resolve that mismatch.
The supplied command explicitly selects '--type compare' and supplies '--competitor', introducing a second product for comparative analysis. That is a materially different operation from the declared single-ASIN weekly reporting purpose. The supplied chunk does not show implementation internals, so no additional data access or side effects are inferred.
The security-relevant mismatch is the inclusion of generic instructions to generate and charge for reports under server-defined first-run exemptions, despite this skill promising user-confirmed weekly reports. The final fixed-entry restrictions mitigate this, but leaving contradictory executable workflows in the same document creates a credible route to unintended credit consumption; the additional read-only features alone are not vulnerabilities.
The chunk documents a watch-management interface rather than the declared user-confirmed AI weekly-report workflow. Events and historical series could support such a report, but watch lifecycle management and digest retrieval materially exceed or differ from the stated purpose. These are reference commands, so the chunk does not establish that any command was actually executed or any charge incurred.
The declared purpose is weekly report generation for an existing subscription, but the supplied chunk exposes subscription lifecycle management. These state-changing capabilities are not merely implementation details of producing a report. The chunk contains no report-generation command. Price acceptance is consistent with the description's confirmed, non-free workflow and is not independently treated as a mismatch.
Reading watch events and historical data could support a weekly report, but the supplied commands extend materially into subscription lifecycle management and price-bearing scheduling, which are not declared. The chunk also exposes watch digest retrieval rather than demonstrating the promised AI report synthesis or confirmation flow. This assessment is limited to the visible command surface; the underlying Python implementation is not supplied.
The command explicitly uses analyze --type compare and supplies --competitor, indicating a two-product comparison rather than the declared single-product weekly brief. Competitor comparison is not described as part of the skill's purpose. The supplied chunk does not establish any additional behavior such as order access, inventory access, or credential misuse.
Generating a weekly report from an existing subscription is materially different from configuring recurring, potentially billable data collection. The declared purpose does not disclose schedule management or enabling paid automatic collection. This assessment is limited to the shown CLI commands and comments; the implementation of scripts/ari.py was not supplied.
The clearest discrepancy is watch digest --watch-id <watchId> --period 7d: the declaration explicitly says this skill is not a watch digest, while the supplied implementation centers on retrieving one alongside events and historical data. Events and series retrieval could support the declared report, but the chunk shows no subsequent report-generation step. The chunk does not establish pricing, API-key enforcement, or whether user confirmation occurs elsewhere.
The generic comparison instructions describe competitor binding as a step that automatically starts weekly collection, without an equally explicit recurring-cost consent gate at that step. Although general authorization rules and the fixed weekly entry reduce risk, an agent following this sequence could treat permission for a one-time comparison as permission for ongoing collection.
The supplied command explicitly selects operations quote --workflow audit --focus full. Although it targets a single ASIN, the selected workflow differs materially from the declared weekly briefing purpose. The chunk does not show weekly-report generation or establish that this audit quote supports that report. It also does not demonstrate audit execution, billing, or access to orders or inventory.
The supplied command explicitly selects a benchmark operation, which is not described as part of the weekly briefing workflow. The underlying script is not supplied, so its exact outputs, API usage, and side effects cannot be verified; the mismatch assessment is limited to the operation selected by the visible command.
The supplied command explicitly selects '--workflow audit --focus full', a broader audit operation not disclosed by the weekly-brief description. Its single-ASIN scope and confirmation flag are consistent with the description. Because the implementation of ari.py is not supplied, the exact audit behavior is uncertain; there is no evidence here of order or inventory access.
run_analysis changes an absent confirmation into confirmation based on the server's autoConfirm field, then calls a chargeable analysis endpoint. cmd_voc similarly permits collection and analysis without --confirm, contradicting the module's explicit-confirmation contract and potentially consuming account credits when an agent expects only a quote.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})