ota-commission-check-free
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for the user to install the "@alipay/agent-payment" package from the public NPM registry. This package is an official component of the Alipay SkillPay ecosystem, which is a well-known and legitimate service for agent skill distribution and payments.
- [COMMAND_EXECUTION]: The skill uses the "Bash" tool to execute a local Node.js engine ("scripts/run.mjs") for deterministic arithmetic calculations. It also documents an "npx" command for users to install the payment-related dependency required for premium features.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts external data input (text or JSON settlement statements) to perform its analysis.
- Ingestion points: Data is loaded from files specified by the user via the "--input" argument in "scripts/run.mjs".
- Boundary markers: There are no explicit markers or safety warnings used when reading the input text before processing.
- Capability inventory: The skill is configured with "Read" and "Bash" tool access.
- Sanitization: The engine extracts and validates numeric fields, but returns raw string data (such as channel names and original line content) in its findings, which are then passed back to the agent context.
Audit Metadata