alipay-payment-feedback
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@alipay/agent-paymentpackage from the NPM registry via thescripts/install-alipay-cli.shscript. This installation process follows security best practices by verifying the package name, version, and maintainer identity, and performing a SHA-512 integrity check against a pinned hash. - [COMMAND_EXECUTION]: The skill executes the
alipay-botCLI tool to submit feedback. During the setup phase, it also executesnpm audit signaturesand a Node.js verification script to ensure the security of the local environment and the authenticity of the installed tools. - [DATA_EXFILTRATION]: The skill transmits user-provided feedback data to official Alipay servers (*.alipay.com). The documentation confirms that this data collection is limited to problem descriptions provided via the
--reasonflag and excludes sensitive credentials or account identifiers.
Audit Metadata