alipay-aipay

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The flow explicitly runs a curl fallback at runtime to fetch official pages from the contracts' sourceUrl (e.g. https://aipay.alipay.com/docs/ai-receive/MACHINE_PAY.md), which means external content is fetched during skill runtime and can directly influence prompts/instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL is explicitly for Alipay payment integration and references payment gateway APIs and CLI commands used to create and test payments (e.g., alipay.trade.page.pay, alipay-cli mcp calls, sandbox payment flows and browser payment entry). These are specific financial-execution functions for a payment gateway rather than generic tooling, so the skill grants Direct Financial Execution capability.