Security audit

alipay-payment-skill

Security checks across malware telemetry and agentic risk

Overview

This is a real Alipay payment skill, but it gives the agent broad payment authority without a clear final user approval before some payment-submission steps.

Install only if you trust the Alipay CLI package and are comfortable with an agent initiating payment flows. Before use, require a fresh explicit approval immediately before submit-payment or 402-buyer-pay, and do not replay Authorization, Cookie, API key, or other secret-bearing headers unless you have verified they are necessary and safe.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The document explicitly instructs the agent to use a generic shell/terminal/exec facility to run payment commands. Even though the intended commands are specific, routing them through a general command-execution tool expands capability beyond the minimum necessary and increases the risk of command injection, tool misuse, or execution of unintended commands if any upstream parameters are attacker-controlled.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill says only commands provided by the skill may be executed, but later introduces an additional curl|grep|sed|tr pipeline for retry handling. This contradiction weakens safety guarantees and invites unsafe operator behavior, because the fallback path uses shell pipelines and re-fetches data in a way the document elsewhere forbids, creating ambiguity that attackers can exploit through crafted URLs or headers.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The document instructs the agent/user to install and then execute an external npm package and its post-install CLI setup path, which expands the skill's behavior from payment handling into arbitrary software installation. Even with a pinned version and integrity check, this still introduces supply-chain and code-execution risk that is not necessary for routine payment processing, and the skill context makes it more concerning because payment-related skills are highly trusted and may handle sensitive workflows.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: The documentation asserts that npm scope ownership and the referenced GitHub organization guarantee official provenance, but the described checks only validate a package hash for a specific published artifact, not organizational control, repository-to-package correspondence, or long-term trustworthiness. This can create a false sense of safety and socially engineer operators into executing code they otherwise would scrutinize.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are overly broad and include common payment-related words such as '支付', '付款', '买单', and '结账', causing the skill to activate on ambiguous user intent or untrusted tool output. In a payment skill, false activation is dangerous because it can steer the agent into executing payment-related shell/CLI flows based on weak contextual signals, increasing the chance of unintended payment actions or disclosure of payment links and state.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The document requires capturing and retransmitting original request headers, which may contain Authorization tokens, cookies, API keys, or other secrets. Reusing such headers without redaction or explicit user consent creates a clear risk of credential exposure to downstream services, logs, tools, or user-visible output.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The workflow explicitly instructs the agent to proceed from session initialization to wallet check and then payment submission without pausing for an explicit user confirmation at the moment of charge. In a payment context, this increases the risk of unauthorized or mistaken payments from ambiguous, stale, or manipulated context, making the skill materially more dangerous than in a non-transactional domain.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The document says that after displaying order information, the agent must immediately continue instead of asking permission. Because the skill can trigger real-money transactions, removing the final consent checkpoint creates a significant risk of accidental or unauthorized payment, especially when links or intents are extracted automatically from conversation context.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases for status queries are broad enough that ordinary conversational statements like '搞定了' or '帮我看看刚才那个订单' may be interpreted as authorization to act on a prior payment flow. In a payment skill, overly permissive triggers can cause unintended status checks against the wrong transaction context or leak transaction state when the referenced payment is ambiguous.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to record and later reuse the original request body and headers, which can contain personal data, bearer tokens, session identifiers, or internal application context. Because the workflow also requires transparent error reporting and user-facing transmission of outputs, these values may be unintentionally surfaced in logs, downstream command invocations, or responses, causing data leakage.

Ssd 3

Medium

Confidence: 84% confidence
Finding: The instruction to be transparent about commands and errors can pressure the agent to reveal full command lines, raw tool output, or debug details that include local file paths, headers, tokens, or other secrets. In a payment context, such over-sharing is especially risky because operational artifacts may contain sensitive payment metadata or credentials.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.