alipay-authenticate-wallet
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@alipay/agent-paymentpackage from the official npm registry. It implements security best practices by requiring a specific version and a SHA-512 integrity hash verification before installation. These resources are provided by the verified vendor 'alipay'.\n- [COMMAND_EXECUTION]: The skill executes thealipay-botCLI to perform wallet operations. It includes instructions for the agent to sanitize shell arguments (e.g., using single quotes and escaping) and strictly limits the environment variables passed to the process to a predefined whitelist.\n- [SAFE]: The skill's operations are consistent with its stated purpose of providing official Alipay wallet services. It contains specific directives to preserve the integrity of signed authorization URLs and QR code paths, ensuring functionality without introducing malicious patterns.
Audit Metadata