HONGKONG-PAYMENT-QFPAY

• Analyzed: May 12, 2026, 3:50 AM
• Findings: 1
• Version: 1.0.0
• Hash: 77a03cf177ed64fe4bcb96a05ead7aaee91b7378d8437cadd9334e6417fe1441
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for QFPay Payment API is benign. The `SKILL.md` and `README.md` provide comprehensive documentation and Python code examples for integrating with a payment gateway. The code correctly uses `os.getenv` for credentials, `hashlib` for signature generation, and `requests` for HTTP communication with legitimate QFPay API endpoints (e.g., `openapi-hk.qfapi.com`). There is no evidence of prompt injection attempts against the AI agent, data exfiltration, malicious execution, persistence mechanisms, or any other harmful behavior. All actions align with the stated purpose of payment processing.