Skills
skills/alipay/payment-skills/alipay-pay-for-402-service/Gen Agent Trust Hub

alipay-pay-for-402-service

Pass

Audited by Gen Agent Trust Hub on Apr 27, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the official @alipay/agent-payment package from the Alipay NPM scope. The skill mandates an integrity check using a SHA-512 hash and version locking to ensure the security of the software supply chain.
  • [COMMAND_EXECUTION]: Executes shell commands via the alipay-bot CLI for payment processing. The skill provides clear defensive instructions, including wrapping parameters in single quotes and enforcing a strict regex for file paths to prevent shell injection vulnerabilities.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: Communicates exclusively with Alipay's official domains for transaction processing. Sensitive data handling is limited to protocol-specific requirements, and the skill explicitly warns against logging or caching sensitive payment links.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 27, 2026, 05:09 AM
Security Audit — agent-trust-hub — alipay-pay-for-402-service