alipay-payment-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 0.0.1

Overview

This payment skill appears purpose-built rather than malicious, but it automates sensitive payment steps with too little confirmation and broad data forwarding.

Install only if you trust the Alipay npm package and are comfortable with a payment skill that may install a CLI, keep it in PATH, check wallet status, forward request details, and submit payment steps after payment intent is inferred. Users should require clear confirmation of payee, amount, and item before any payment command is run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cashier-payment.md:191

Finding

Shell Command Injection Through an Insufficiently Validated Payment URL

Content

View full analysis

Vulnerability Details

File Location: references/cashier-payment.md:191-206
Vulnerability Type: Shell command injection through user-controlled URL interpolation
Risk Level: High

Vulnerable Code

bash

AIPAY_SESSION_ID=<sessionId> AIPAY_FRAMEWORK=openclaw alipay-bot submit-payment --payment-link '<cashier-payment-link>' --session-id <sessionId>

The preceding validation requires an existing HTTPS URL, an Alipay cashier hostname, a path, and complete query parameters. It does not explicitly reject embedded single quotes, control characters, shell operators, or other characters capable of escaping the shell argument.

Technical Analysis

The payment link originates from the conversation context and is inserted directly into a shell command. Although the value is surrounded by single quotes, single-quote wrapping is not safe when the input itself may contain a single quote.

An attacker can supply a crafted value that begins like an accepted Alipay cashier URL but contains a single quote followed by shell syntax. If validation is implemented as the documented prefix and hostname checks rather than strict URL parsing and argument-safe process execution, the quote closes the intended argument and the remaining text is interpreted by the shell.

Domain validation alone does not prevent this issue. The input must either be passed directly as a process argument without invoking a shell or be subjected to strict URL parsing and robust shell escaping.

Attack Path

1. An attacker supplies a payment link that appears to use an allowed Alipay cashier hostname.
2. The crafted link includes a single quote and shell operators after the hostname or path.
3. The documented validation accepts the value because it starts with HTTPS and contains an expected cashier hostname.
4. The Skill substitutes the value into the single-quoted --payment-link argument.
5. The embedded quote terminates the ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct a shell command string. Invoke alipay-bot through a process API that accepts an argument array, passing the payment URL as one literal argument.
2. Parse the URL with a standards-compliant URL parser and reject parsing failures.
3. Require the https scheme and compare the normalized hostname against an explicit allowlist or a suffix rule with a dot-boundary check.
4. Reject user-info components, control characters, whitespace, quotes, backticks, line breaks, and shell metacharacters.
5. Do not rely on manual single-quote wrapping. If shell execution is unavoidable, use a proven escaping library independently for every dynamic argument.
6. Add tests covering embedded quotes, semicolons, command substitutions, newlines, encoded delimiters, malformed hostnames, and deceptive hostname suffixes.
7. Run the payment process under a dedicated least-privileged account with restricted filesystem and network access.

T08 · Insecure Dependencies

Warning

• Location: references/cli-setup.md:24

Finding

Execution and PATH Installation of an Externally Retrieved npm Package

Content

View full analysis

Vulnerability Details

File Location: references/cli-setup.md:24-40
Vulnerability Type: Third-party package execution and system PATH modification
Risk Level: Medium

Vulnerable Code

bash

npm view @alipay/agent-payment@1.0.3 dist.integrity

Expected integrity value:

text

sha512-JhFHJ1VcCC3gALnAaIWn3a7Hnfo7BFIViOWL8h8HrNp/Hzry1tc40YV5ulJfg+Xhnb5CR/Ye6tsXX9UfgeKDTA==

Installation and execution:

bash

npm install @alipay/agent-payment@1.0.3 && npx @alipay/agent-payment@1.0.3 install-cli

The installation instructions state that install-cli places the alipay-bot executable in the system PATH.

Technical Analysis

The Skill package does not include the source code of @alipay/agent-payment or the installed alipay-bot executable. Nevertheless, it instructs the Agent to download the package, execute npm installation behavior, run the package through npx, and install a tool into PATH.

The fixed package version, explicit expected SHA-512 integrity value, official registry, and requirement for user approval materially reduce supply-chain risk. However, the effective executable payload remains external to the audited project, and npm installation can execute package lifecycle behavior unless scripts are explicitly disabled. Installing a command into PATH also expands the trust boundary because subsequent legitimate-looking alipay-bot calls rely on the installed executable.

There is also a documentation inconsistency: references/security.md:7-9 states that the dependency is fixed at version 1.0.0, while SKILL.md and references/cli-setup.md install version 1.0.3. This inconsistency can undermine review and operational verification, although the executable commands themselves consistently specify 1.0.3.

Attack Path

1. The Skill determines that alipay-bot is not installed.
2. The user approves installation of the external npm package.
3. The ...[truncated 1277 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and audit the exact CLI artifact or publish its reproducible source and build provenance alongside the Skill.
2. Download the package without executing it, calculate its digest locally, and compare it to an independently trusted digest before installation.
3. Use npm options that disable lifecycle scripts during package retrieval where compatible with the deployment design.
4. Avoid npx package resolution for security-sensitive execution. Execute a locally verified artifact by an absolute path.
5. Install the CLI into a Skill-specific, non-global directory rather than modifying the system PATH.
6. Run the external tool inside a sandbox with minimal filesystem, environment, process, and network access.
7. Preserve the fixed version and integrity requirement, and fail closed on any mismatch.
8. Synchronize references/security.md with the actual pinned version 1.0.3.
9. Verify package signatures or provenance attestations in addition to the npm integrity field.
10. Document uninstall and cleanup procedures so the executable does not remain available longer than necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document defines a safety rule forbidding extra HTTP requests to the same resource before payment, then later instructs a retry flow that uses curl to fetch Payment-Needed again. This contradiction can cause duplicate or unintended requests to merchant endpoints, potentially replaying side effects, refreshing payment state incorrectly, or bypassing the workflow's own anti-reuse guarantees.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow explicitly instructs the agent to continue from order display into wallet check and then toward payment submission without pausing for user confirmation. In a financial workflow, this removes a critical consent checkpoint and increases the risk of unauthorized or mistaken payment initiation from ambiguous, stale, or manipulated context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill mandates immediate submit-payment once wallet authorization is detected, with no warning that a real payment request is about to be sent. In a live payment system, automating the transition from eligibility check to payment initiation without renewed consent creates a high risk of unintended financial action and weakens user control over irreversible or time-sensitive transactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

L202-L208 明确说明 Payment-Needed 文件名可使用安全字符集合，并推荐 402_needed_<timestamp>.txt 这样的动态文件名。可是 L423 又声明只能使用 4 个固定标准名，明确禁止 402_payment_<数字>.txt 等自创文件名，这与前述推荐做法直接冲突，会导致执行者无法同时满足两处要求。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

该流程要求把 402 原始请求中的 resource-url、method、data、headers 原样透传到 402-buyer-pay，相当于让技能向外部目标发送用户或上游提供的数据。即使文档有部分文件名约束，这里仍可能导致敏感请求头、请求体或内部 URL 被转发到不受信任目标，形成 SSRF、数据外传或带凭据请求风险。

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

│  文件名不合规 → 拒绝执行（可能是注入攻击）
  │  ═════════════════
  │  同时记录 resource-url、method（默认GET）、data、headers
  │  [禁止] 在 buyer-pay 之前对同一 URL 发起额外 curl 请求
  ↓
Step 2: 402-buyer-pay -f '<file>' -r '<resource-url>' [-m '<method>'] [-d '<data>'] [-H '<key:value>']
  │  ═══ POST 参数规则（原始请求为 POST 时必须遵守）═══

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Manifest 在 L011 说明当用户意图是开通/授权/解绑支付能力或查询开通状态时，应由 alipay-authenticate-wallet 处理，本技能不应被触发。 但 L373 的“AI支付产品介绍”流程却要求先 check-wallet，并在未授权/未开通时中断切换到 authenticate-wallet，这使得本技能会先介入一个按总规则本不应由其处理的授权场景，文档意图存在冲突。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

10. **query 成功后禁止重复查询**：402-query-payment-status 返回 success=true 后，唯一出路是 Step 5。禁止再次执行 query、禁止执行任何非 skill 定义的命令（如 `402-query-order` 等不存在的命令）
11. **tradeNo 非 32 位时绝对禁止执行后续命令**：校验不通过 = 立即 STOP，禁止执行 query、fulfillment-ack 等任何后续命令
12. **body 为空时绝对禁止执行 fulfillment-ack 和声称成功**：resourceResponse.body 为空 = 立即 STOP，禁止执行 fulfillment-ack，禁止输出"支付成功"/"购买成功"等成功信号词
13. **402-query-payment-status 的 HTTP 方法参数是 -m 不是 -X**：`-X` 是 curl 的参数，alipay-bot 不支持。正确：`-m POST`；错误：`-X POST`
14. **禁止使用非 skill 定义的命令**：如 `402-query-order` 等不存在的命令，skill 中只定义了 `check-wallet`、`402-buyer-pay`、`402-query-payment-status`、`402-buyer-fulfillment-ack`、`problem-feedback`
15. **可重试错误码必须重试满3次**：402-buyer-pay 遇到 SERVER_TIMEOUT/CLIENT_TIMEOUT/SYSTEM_ERROR 等可重试 errorCode 时，必须重试满3次才 STOP。禁止只重试1次就放弃
16. **fulfillment-ack 可重试错误必须重试满3次**：遇到 TR_FULFILLMENT_FAILED/FULFILLMENT_FAILED/SYSTEM_ERROR 等可重试 errorCode 时，同 tradeNo 重试，第1次→第2次→第3次→仍失败才 STOP。禁止只重试1次就放弃

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions require forwarding original request headers into later payment-related commands, but custom headers commonly contain bearer tokens, cookies, API keys, or session identifiers. This can propagate sensitive credentials into logs, subprocess arguments, tool telemetry, or external payment tooling without any minimization or redaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/402-payment.md (reported line 101)May include surrounding context.

示例：

text

原始请求: curl -X POST <url> -H 'Content-Type: application/json' -d '{"city":"杭州","queryDate":"2026-04-16"}'
→ 402-buyer-pay -f 402_payment.txt -r <url> -m POST -d '{"city":"杭州","queryDate":"2026-04-16"}' -H 'Content-Type:application/json'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The retry instructions tell the agent to issue an extra HTTP request to the resource URL to recover Payment-Needed, which may resend user inputs and merchant-request context without warning. If the original request was state-changing or contained sensitive data, this can leak data, duplicate actions, or alter payment state unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says only commands provided by the skill may be executed, but elsewhere directs the agent to use shell/terminal/exec and even curl. Conflicting execution rules increase the chance that an agent will run unvetted commands or broaden its tool usage beyond the intended trust boundary, which weakens command-control safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases for status checks are broad enough to match ordinary conversational language like '搞定了' or '看看刚才那个订单', which can cause the skill to query payment status without clear user intent or sufficient binding to a specific payment session. In a payment context, even read-oriented actions can disclose sensitive transaction state or act on the wrong order when multiple payments exist in context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Automatically running payment-status queries on broad statements like '已支付' or '帮我看看' without verifying which payment is in scope can cause the assistant to access or reveal the status of the wrong transaction. In shared or complex conversational contexts, this weak session integrity and may expose sensitive financial metadata or mislead the user about payment completion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document is primarily written in Chinese and presents the setup flow in that language without indicating that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file enforces fixed Chinese-language output and exact verbatim reproduction of tool-returned Markdown, without preserving user language preference or offering opt-in. In a payment skill, this can degrade informed consent and comprehension, causing users to misunderstand payment, authorization, or error instructions, which increases the risk of unsafe user actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file begins entirely in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown states that all inputs and outputs must use UTF-8 encoding as an absolute requirement. While UTF-8 is often reasonable technically, this is a language/locale-related constraint presented as mandatory without offering user choice or explaining a region-specific policy need, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

将非交易性的“产品介绍”请求强制绑定到 check-wallet，会在用户仅想了解产品时触发账户状态探测。这会造成不必要的隐私暴露和外部数据传输，也扩大了技能的权限使用面，使支付相关能力被过度调用。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

前文已明确定义 query-payment-status 为 Step 4（L278-L314），但这里写成“执行 Step 3 query-payment-status 查询最新状态”。同类矛盾还出现在检查点中把“用户在下一轮表示已支付或查询状态时”也写成执行 Step 3（L350），会误导调用方在错误步骤执行状态查询。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

文档前文把 submit-payment 定义为 Step 3，把 query-payment-status 定义为 Step 4；但该检查点却写成“执行 Step 3 查询支付状态”。这不是简单省略，而是对流程步骤的直接性错误描述，可能导致实现者在支付提交后错误复用 Step 3 逻辑。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document is written as normative guidance entirely in Chinese, starting with the title and continuing through all operational instructions, but it does not offer an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.