wechatpay-basic-payment
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python scripts in the
scripts/directory for the AI agent to execute. These scripts perform legitimate order and refund queries against the official WeChat Pay API domain. These tools are used for diagnostics and require explicit user consent and server-side signed values before execution. - [EXTERNAL_DOWNLOADS]: The Go and Java example code references standard community libraries for cryptography and HTTP operations, such as
github.com/tjfoc/gmsm/sm3,okhttp3, andgoogle-gson. These are standard, reputable dependencies for the domain. - [SAFE]: All credentials,商户号 (merchant IDs), and keys provided in the code snippets are placeholders or dummy data clearly intended for illustrative purposes. No real secrets are exposed.
- [SAFE]: The skill implements a robust "Step-by-Step Confirmation Protocol" in
SKILL.md, explicitly instructing the AI to never assume values and to wait for user approval before performing any diagnostic actions. It also strictly forbids the AI from using file-modification tools on the user's codebase.
Audit Metadata