微信跨境支付接入Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a WeChat Pay Global documentation helper, but it needs review because it tells users to email payment logs or code evidence without redaction guidance and contains conflicting onboarding eligibility guidance.

Review this skill before installing for payment-operation use. If you use its go-live checklist, do not email raw logs, screenshots, credentials, Authorization headers, private keys, callback payloads, customer identifiers, transaction IDs, or production code; verify the support channel independently and share only sanitized evidence. Also confirm direct-connection eligibility against current official WeChat Pay documentation because the artifact is internally inconsistent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/1-机构/接入指南/接入质量检查.md:207

Finding

Potential Disclosure of Sensitive Payment Logs and Source Code Through Email

Content

View full analysis

- ` - The body must include: - A list of integrated products - Item-by-item check results for each module. It is recommended to attach a sample log or a screenshot of a code snippet as evidence. - Primary contact person and contact information ``` ```markdown | # | Brief check item | Passed | Sample log / code snippet | |---|------------------|--------|---------------------------| | 1 | xxx | Yes | Attach log or screenshot | | 2 | xxx | Yes | ... | Send the contents of this report by email to technical support (`[e-mail]`) and wait for confirmation. ``` ```markdown | Step 3: Reply to technical support by email and provide a sample log | Pending | ``` ### Technical Analysis The quality-assurance workflow directs users to transmit sample logs, source-code snippets or screenshots, merchant identifiers, and contact details through email. It does not require users to redact secrets or personal information, verify the recipient through an independently trusted channel, minimize the submitted data, or use an approved encrypted support portal. Payment integration logs and code can contain sensitive material such as: - API authorization headers and request signatures - Merchant or institution identifiers - Transaction and refund identifiers - ...[truncated 2712 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest contains broad payment-related trigger phrases across multiple languages, which can cause the skill to activate for generic payment questions outside the intended WeChat Pay Global scope. Misrouting is risky here because this skill contains authoritative-seeming integration rules and routing behavior; if invoked for the wrong product or environment, it may provide incorrect compliance, API-domain, or operational guidance for live payment systems.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/1-机构/产品选型/产品介绍.md (reported line 648)May include surrounding context.

md

## 六、机构模式：请求体必带字段


| 字段                         | 含义                          | 必填条件                                                                                          |
| -------------------------- | --------------------------- | --------------------------------------------------------------------------------------------- |
| `sp_mchid`                 | 机构号（机构主体的 mchid）            | ✅ 全部接口必填（无论收款还是平台扩展类）                                                                         |
| `sp_appid`                 | 机构 AppID（机构主体名下绑定的 AppID）   | ✅ 大多数接口必填，详见各 API 文档                                                                          |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/1-机构/产品选型/产品介绍.md (reported line 652)May include surrounding context.

md

| -------------------------- | --------------------------- | --------------------------------------------------------------------------------------------- |
| `sp_mchid`                 | 机构号（机构主体的 mchid）            | ✅ 全部接口必填（无论收款还是平台扩展类）                                                                         |
| `sp_appid`                 | 机构 AppID（机构主体名下绑定的 AppID）   | ✅ 大多数接口必填，详见各 API 文档                                                                          |
| `sub_mchid`                | 子商户号（实际收款 / 被代办的子商户）        | ✅ 全部接口必填                                                                                      |
| `sub_appid`                | 子商户 AppID                   | ⚠️ 当需要用子商户 AppID 取 `sub_openid` 时必填（JSAPI / 小程序 / 部分 APP / 委托代扣）；也可用 `sp_appid` 取 `sp_openid` |
| `sub_openid` / `sp_openid` | 用户在子商户 / 机构 AppID 下的 openid | JSAPI / 小程序 / 委托代扣 必填                                                                         |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/1-机构/产品选型/产品介绍.md (reported line 662)May include surrounding context.

md

## 七、业务规则速查（纯业务，不含开发参数）


| 规则      | 取值 / 说明                                                                                 |
| ------- | --------------------------------------------------------------------------------------- |
| 金额单位    | **最小货币单位的整数**（如美分），杜绝浮点                                                                 |
| 币种      | `amount.currency` **必填**，按子商户实际收款币种填，使用 ISO 4217 三位字母代码                                 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The source citation and linked documentation are explicitly fixed to the Chinese-language path (/zh/), and the document does not indicate that alternative language/localization options may be used. Under the policy for natural-language violations, forcing a specific language or locale without user opt-in can be a violation unless clearly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document gives conflicting guidance about where direct connection mode is permitted: one section says only Hong Kong is allowed globally, while later sections say Hong Kong and the UK are open, and another repeated rule again says only Hong Kong. In a payment-integration skill, such contradictions can misroute implementers into an ineligible onboarding path, causing compliance mistakes, failed integrations, or incorrect business decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly recommends sending sample logs or code screenshots to technical support as evidence, but gives no instruction to redact secrets or minimize shared data. In a payment integration context, those artifacts can easily contain API keys, merchant identifiers, callback payloads, signatures, tokens, customer identifiers, or transaction details, creating a real risk of sensitive-data leakage through email.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/1-机构/接入指南/接入质量检查.md (reported line 336)May include surrounding context.

md

|---|---------|-------|---------|---------|
| 1 | 前置处理 | 是否在**微信开放平台**（非公众平台）注册移动应用 | 已在 open.weixin.qq.com 创建移动应用并审核通过 | 调起失败 |
| 2 | 前置处理 | 移动应用 AppID 是否与商户号绑定 | 商户平台完成绑定 | `APPID_MCHID_NOT_MATCH` |
| 3 | 前置处理 | iOS 是否配置 URL Scheme | Info.plist 配置 URL Scheme = AppID | 支付完不能跳回 App |
| 4 | 前置处理 | iOS 是否配置 Universal Link | HTTPS 域名根目录有 `apple-app-site-association` | 支付完不能跳回 App（新版微信强制） |
| 5 | 前置处理 | Android 包名 / 签名 MD5 是否与开放平台注册一致 | 发布 APK 的签名 MD5 与开放平台填写一致 | 调起微信失败 |
| 6 | 字段规范 | `mchid` / `appid` 是否正确 | 与已绑定的移动应用 AppID 一致 | 下单失败 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The internal report template asks operators to include sample logs or code snippets and then email the report to support, again without any warning about sensitive-content handling. Because this template is likely to be reused operationally, it normalizes transmitting potentially confidential implementation details and payment traces, increasing the chance of credential, PII, or financial metadata exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Although the file itself is written in Chinese, the listed '官方文档' links in the main product, extension, and cryptography sections all point to /en/ documentation only. This imposes a specific language/locale on users without opt-in, which matches the policy category for language-choice violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L59-L60 明确写明“报关只支持大陆身份证实名认证的用户”，并进一步排除港澳回乡证、护照、台胞证及香港钱包用户。这属于自然语言层面的语言/区域/身份适用性限制，但当前文档未在开头显式说明这是海关或业务合规导致的地区性约束，容易构成未充分说明的 locale/region policy 限制。

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L003 states that the AI must use the glossary's prescribed translations for the same concept in all conversations and must not replace them arbitrarily. This imposes a fixed language/terminology policy globally rather than offering user choice or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction '不确定语言时默认英文' imposes English as the fallback language automatically. Per the policy, forcing a specific language without user choice can be a locale/language policy violation unless the user is offered an option or the constraint is justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill declares a capability for '示例代码指引' and routes users asking for code examples to an interface index, while line L72 explicitly states the model must not generate demo or calling code itself. This is not a security flaw in execution, but it is an intent/documentation tension inside the skill instructions because 'example code guidance' could be read as code generation while the rule forbids it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The text states that all skill documents are written from the institution perspective and consistently uses Chinese-language global documentation context, while the file does not indicate any user language choice or opt-in. Under the stated policy, forcing a specific language or locale without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The title explicitly scopes the guidance to '境外机构' (overseas institutions), and the document consistently prescribes this locale-specific API path and behavior as the default. Because the file does not offer a user choice or state that the locale restriction is optional, it can be read as enforcing a locale-specific workflow rather than letting users select the appropriate region.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Line L094 strongly recommends forcing a specific response language and the supported values are limited to zh-CN, zh-HK, zh-TW, and en. Under the stated policy, language constraints should either be user-selectable or clearly justified; this line does not mention user preference or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This file is entirely written in Chinese and presents itself as the canonical usage guide for the skill context without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

该技能文档全文以中文提供操作说明，但未见任何语言选择、双语提示或明确声明仅面向中文使用者。根据规则，若技能在自然语言层面强制特定语言且无用户选择或合理限定，可视为语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/1-机构/接入指南/签名与验签规则.md:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/1-机构/接入指南/网络问题指引.md:217