汇付支付集成

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 9:06 AM UTC
• Version: 1.3.5

Overview

This is a Huifu payment-integration guidance skill with disclosed sandbox and credential-handling instructions, not a self-executing tool, but users should treat payment data and sandbox secrets carefully.

Install only for Huifu payment integration work. Do not paste production private keys, real identity numbers, openid/buyer IDs, or full payment logs into chat; keep sandbox-credentials.json local and out of git; review generated code for date preservation, redaction, encryption, retention, webhook verification, and idempotency before using it in联调 or production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The file’s own guidance says upstream-provided fields must be preserved and invalid input should trigger an explicit error, but the reconciliation example recomputes `file_date` locally and overwrites any caller-supplied value. In a payment reconciliation workflow this can cause operators to query or download the wrong billing file, leading to mismatched accounting, missed exception handling, or accidental disclosure of the wrong settlement dataset.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation without any visible trigger constraints, exclusions, or narrowing conditions. That can cause the agent to auto-select this payment integration skill in loosely related conversations, increasing the chance of unintended payment-related guidance, leakage of contextual user data into the skill flow, or unsafe execution paths in sensitive financial contexts.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This section documents privacy-sensitive fields such as buyer account identifiers, card/account numbers, device IP/location, and other payment-related metadata, but only provides a narrow warning for `buyer_logon_id`. In a payment integration skill, insufficient guidance on minimizing, masking, logging restrictions, and retention of these fields can lead downstream implementers to store or expose regulated personal and financial data unsafely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section documents fields for highly sensitive financial and personal data, including bank card numbers, payer names, client IPs, and redirect URLs, but it does not explicitly warn implementers about data classification, encryption, masking, storage minimization, or logging restrictions. In a payment integration skill, that omission can lead developers to handle regulated data unsafely, increasing the chance of leakage through logs, telemetry, debugging output, or insecure transport/storage.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly recommends storing raw channel extension JSON while the same file defines fields such as `openid`, `sub_openid`, `buyer_id`, bank/account identifiers, and possibly account-holder names. Encouraging raw persistence of these payment-related identifiers without minimization, masking, retention, or access-control guidance can lead implementers to retain unnecessary sensitive data, increasing privacy exposure and breach impact.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly describes collecting and transmitting payer identity data such as name, ID type, and ID number, and only notes that the ID number should be RSA-encrypted. It does not give integrators clear privacy, data-minimization, storage/retention, logging, or access-control guidance, which increases the risk that highly sensitive personal data will be over-collected, mishandled, or exposed during implementation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly describes API response fields containing persistent user/payment identifiers such as `wx_user_id`, `openid`, and `sub_openid` without any guidance on masking, access control, retention, or safe logging. In a payment-integration skill, this increases the chance that downstream agents or developers will expose regulated personal/payment data in logs, prompts, analytics, or UI output.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes buyer account fields `buyer_id` and `buyer_logon_id`, which are directly privacy-sensitive and can enable account correlation or accidental disclosure if copied into logs or support traces. Because this skill is meant to help integrate payment APIs, omission of handling warnings materially raises the risk of secondary exposure by consumers of the skill.

Credential Access

High

• Category: Privilege Escalation

Content

控制台“接入信息”区域会从公开索引 `hf-payment-local-sandbox-latest.json` 检查更新。检查更新不需要 `admin_token`，不上传私钥、公钥、`sys_id`、`product_id`、`huifu_id`、请求日志、报告、Webhook 地址或 Notify 地址；只读取公开 JSON，并在有新版时展示当前平台下载地址、文件名、大小和 SHA256。沙箱不做静默自动安装，用户下载新版后手动解压并重新启动。

3. 查看或导出 `official-demo` Profile。普通用户优先通过页面“导出凭证”下载 `sandbox-credentials.json`；命令行导出只作为维护者排障能力。无论哪种方式，都不要在文档、日志和报告里回显完整私钥。

`official-demo` 用户可见字段固定为 `product_id`、`sys_id`、商户请求签名私钥、沙箱响应验签公钥和 Webhook 终端密钥。预览包不内置完整私钥；首次使用时会在本机生成或读取 `sandbox-data/credentials/official-demo-merchant-private.pem` 和 `sandbox-data/credentials/official-demo-sandbox-private.pem` 两套 RSA 私钥。本地沙箱模式下，请求签名使用导出的商户私钥；沙箱用本机保存的商户请求验签公钥验请求签名；响应和通知由本机沙箱私钥加签；客户项目优先用导出的 `merchant_public_key` 验响应和通知签名。页面导出的 `sandbox-credentials.json` 只面向商户项目配置，和“复制配置”保持同一套扁平英文 key：`gateway_url`、`sys_id`、`product_id`、`huifu_id`、`skill_source`、`merchant_private_key`、`merchant_public_key`、`webhook_endpoint_key`、`signature_model`、`usage`，不再包含重复的 `merchant_config`、`sandbox_config` 或说明型嵌套层。官方 SDK 优先字段为无 PEM 头尾、无换行的 PKCS8 Base64 `merchant_private_key` 和 X509 Base64 `merchant_public_key`；Webhook 验签使用 `webhook_endpoint_key` 计算大写 `MD5(raw_body + webhook_endpoint_key)`，业务代码可用大小写不敏感比较兼容历史实现；本地配置直接给出样例 `huifu_id = 6666000100000001`。本地沙箱模式下 `skill_source` 固定使用 `hfps/1.3.1;sandbox/1.0.1`；官方联调或生产环境使用 `hfps/1.3.5`，不要携带 `;sandbox/...` 后缀。报告中必须保留 `signature_model = dual_key_local_sandbox`。

• Confidence: 72% confidence
• Finding: The guidance encourages exporting a `sandbox-credentials.json` containing a merchant private key and webhook secret for direct project configuration. Even though these are sandbox credentials, packaging private key material into an easily copied file increases the chance of accidental disclosure, reuse in unsafe environments, or confusion with production handling patterns.

Credential Access

High

• Category: Privilege Escalation

Content

3. 查看或导出 `official-demo` Profile。普通用户优先通过页面“导出凭证”下载 `sandbox-credentials.json`；命令行导出只作为维护者排障能力。无论哪种方式，都不要在文档、日志和报告里回显完整私钥。

`official-demo` 用户可见字段固定为 `product_id`、`sys_id`、商户请求签名私钥、沙箱响应验签公钥和 Webhook 终端密钥。预览包不内置完整私钥；首次使用时会在本机生成或读取 `sandbox-data/credentials/official-demo-merchant-private.pem` 和 `sandbox-data/credentials/official-demo-sandbox-private.pem` 两套 RSA 私钥。本地沙箱模式下，请求签名使用导出的商户私钥；沙箱用本机保存的商户请求验签公钥验请求签名；响应和通知由本机沙箱私钥加签；客户项目优先用导出的 `merchant_public_key` 验响应和通知签名。页面导出的 `sandbox-credentials.json` 只面向商户项目配置，和“复制配置”保持同一套扁平英文 key：`gateway_url`、`sys_id`、`product_id`、`huifu_id`、`skill_source`、`merchant_private_key`、`merchant_public_key`、`webhook_endpoint_key`、`signature_model`、`usage`，不再包含重复的 `merchant_config`、`sandbox_config` 或说明型嵌套层。官方 SDK 优先字段为无 PEM 头尾、无换行的 PKCS8 Base64 `merchant_private_key` 和 X509 Base64 `merchant_public_key`；Webhook 验签使用 `webhook_endpoint_key` 计算大写 `MD5(raw_body + webhook_endpoint_key)`，业务代码可用大小写不敏感比较兼容历史实现；本地配置直接给出样例 `huifu_id = 6666000100000001`。本地沙箱模式下 `skill_source` 固定使用 `hfps/1.3.1;sandbox/1.0.1`；官方联调或生产环境使用 `hfps/1.3.5`，不要携带 `;sandbox/...` 后缀。报告中必须保留 `signature_model = dual_key_local_sandbox`。

4. 已有项目使用本地沙箱时，不是另写一套“SDK 接入指南”，而是在项目现有支付出口层增加仅本地启用的 `local-sandbox` 运行模式。先尝试把官方 SDK 的网关基础地址、base URL、endpoint 或 HTTP client 配置为 `gateway_url`；如果 SDK 没有暴露这类配置项，则保留生产路径继续走官方 SDK，只在项目自己的支付网关封装层增加本地分支：复用原有订单组装、字段校验、幂等键和请求对象，发送阶段按汇付 envelope POST 到 `gateway_url + 接口路径`，响应再转换回项目原有业务服务接口。不要改官方 SDK 源码，不要用 hosts 劫持官方域名到本机，也不要让本地分支在生产环境默认启用。

• Confidence: 77% confidence
• Finding: The document specifies that `sandbox-credentials.json` includes `merchant_private_key` and `webhook_endpoint_key` in a flat config format intended for application consumption. This normalizes embedding secret material directly into application configuration, which can lead to leakage through logs, source control, build artifacts, or developers carrying the same pattern into production integrations.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.