payment-skill
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill adheres to security best practices by managing sensitive credentials (such as WeChat Pay API V3 keys and private certificates) through environment variables rather than hardcoding them in the source code or Dockerfile. The documentation provides clear instructions on secure configuration.
- [SAFE]: External network communications are limited to official WeChat Pay API endpoints (
api.mch.weixin.qq.com) and well-known CloudBase service domains. All communications are required to be over HTTPS. - [SAFE]: The skill relies on official and reputable third-party libraries, including
wechatpay-node-v3andwx-server-sdk, for cryptographic operations and platform integration. No suspicious or unverified dependencies were identified. - [SAFE]: Authentication and authorization mechanisms are correctly implemented using CloudBase's native security headers (
x-wx-openid) and JWT parsing, ensuring that payment operations are associated with verified user identities.
Audit Metadata