alipay-pay-for-service

• Risk level: Low
• Analyzed: Apr 21, 2026, 4:38 AM
• Findings: 0
• Version: 1.0.9-beta1

Overview

The skill's requirements and runtime instructions are consistent with a CLI-based Alipay payment helper: it asks to install an official npm package that provides alipay-bot, uses only that CLI plus curl, requests user consent before installing, and does not demand unrelated credentials or privileged system access.

This skill appears coherent for handling Alipay cashier links and uses an npm package that provides the alipay-bot CLI. Before installing, ensure you: (1) confirm the package integrity value matches the declared sha512 hash (the SKILL.md explicitly instructs this), (2) install only after explicit user permission, (3) keep installations isolated or review the package source (https://github.com/alipay/payment-skills and npm page) if you need higher assurance, and (4) follow the guidance to avoid logging or sending the one-time payment URLs through unintended channels. Remember that an npm package runs third-party code on your system — integrity checks and pinned versions reduce risk but do not eliminate supply-chain concerns.