payment-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's createPayment flow and example response require returning provider-generated tokens (prepay_id, nonceStr, paySign, etc.) verbatim to the client, so an agent implementing it would handle and emit sensitive payment tokens directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). payment-skill 在运行时通过 apis/createPayment.js 将来自业务方/用户传入的 description 等字段发送到后端 cloudfunctions/pay-common 的 HTTP 云函数 (/wx-pay/wxpay_order)；该后端会将请求体 JSON 明文解析并用于下单，因此存在“外部可控 free text 被后端读取”的间接注入面。

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a WeChat Pay integration: it defines createPayment that calls the WeChat Pay JSAPI to obtain a prepay_id and returns payment parameters (timeStamp, nonceStr, package, paySign) for client-side payment, and a cloud function (payment-skill-handler) that performs createPayment and queryPayment against the payment provider. This is a purpose-built payment gateway integration (directly moves/executes payments), so it grants direct financial execution authority.