wechatpay-basic-payment
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides developer-oriented documentation and example code for WeChat Pay integration, using official domains and standard practices.
- [SAFE]: No hardcoded credentials or sensitive tokens were detected in the provided code samples; all sensitive parameters use clearly marked placeholders like '19xxxxxxxx'.
- [SAFE]: The diagnostic Python scripts (
scripts/商户/查询订单.pyandscripts/服务商/查询订单.py) are designed for troubleshooting and exclusively communicate with official WeChat Pay API endpoints (api.mch.weixin.qq.com). - [SAFE]: The skill's global rules explicitly forbid the agent from performing unauthorized file modifications or generating code from scratch, which significantly reduces the risk of accidental insecure implementation.
- [SAFE]: The troubleshooting process utilizes a 'signature mode' which ensures that private API keys never enter the AI agent's environment, as the user is instructed to perform the cryptographic signing on their own secure server.
- [PROMPT_INJECTION]: The skill contains strict interaction guidelines intended to constrain the AI's behavior for safety and accuracy (e.g., '只检索、不生成'), which are benign in this context.
Audit Metadata