payment-fee-check-free

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The SKILL.md file contains instructions intended for an AI assistant to download and install the @alipay/agent-payment package from the NPM registry via the npx utility. This targets the official repository of a well-known financial technology provider.
  • [COMMAND_EXECUTION]: The skill requires the Bash tool to execute its local processing scripts (scripts/run.mjs and the underlying Node.js engine). This is consistent with the skill's stated purpose of local data processing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided transaction data to perform verification, which presents a surface for processing untrusted content.
  • Ingestion points: The run.mjs script ingests input via the --input argument, which can be a JSON file containing a text field or a raw text file.
  • Boundary markers: No explicit delimiters are used to wrap the input text before processing.
  • Capability inventory: The skill utilizes file system read access (node:fs) and shell command execution via the Bash tool as declared in the frontmatter.
  • Sanitization: The engine (payment-fee-check.js) performs normalization of numeric values and uses regular expressions to identify blank fields or placeholders, reducing the risk of processing non-numeric malicious payloads as valid data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 11:28 AM
Security Audit — agent-trust-hub — payment-fee-check-free