HONGKONG-PAYMENT-QFPAY

• Outcome: Pass
• Latest audit: May 28, 2026, 11:49 AM
• Version:
  1.0.0

Overview

This is a documentation-only QFPay payment integration skill, with expected payment and credential guidance but no evidence of hidden execution or data misuse.

Use this only for QFPay integration. Start with sandbox or test credentials, keep QFPAY_KEY and merchant credentials out of source control, shared terminals, logs, and chat, and require explicit user approval before any production payment or refund.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README instructs users to export payment API credentials directly as shell environment variables but does not include any guidance about secure handling, such as avoiding shell history capture, process inspection exposure, accidental logging, or committing values into scripts. In a payment-integration skill, these secrets can authorize API calls and access merchant resources, so weak operational guidance increases the chance of credential leakage even though the document itself does not expose real secrets.

VirusTotal

66/66 vendors flagged this skill as clean.