Skills
skills/alipay/ai/alipay-payment-feedback/Gen Agent Trust Hub

alipay-payment-feedback

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's installation script fetches the @alipay/agent-payment package from the NPM registry. This is a vendor-official resource used to facilitate payment feedback functionality.
  • [REMOTE_CODE_EXECUTION]: The install-alipay-cli.sh script performs a controlled installation and execution of the agent-payment binary. The process is highly secured through multiple validation layers, including a pinned SHA-512 integrity hash, strict version locking (1.0.0), and verification of the official Alipay maintainer account.
  • [COMMAND_EXECUTION]: The skill uses the alipay-bot CLI tool specifically for the problem-feedback function. The command is restricted to submitting problem descriptions provided by the user via the --reason parameter.
  • [DATA_EXFILTRATION]: User-provided problem descriptions are transmitted to official Alipay servers (*.alipay.com). The skill's instructions specifically prohibit the collection of credentials or sensitive personal information, focusing solely on technical feedback.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 07:01 PM
Security Audit — agent-trust-hub — alipay-payment-feedback