Alipay Pay For Service

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 1.0.9-beta1

Overview

This payment skill is mostly purpose-aligned but needs review because it runs external package code and documents unsafe shell handling for payment links.

Review before installing. Only use this in a sandboxed environment, approve installation only if you trust the pinned Alipay npm package, and do not pass payment links through shell-interpolated command strings unless the runner uses structured arguments or robust escaping.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unreviewable External npm Package Is Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-64
Vulnerability Type: Supply-chain exposure through externally downloaded executable code
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm view @alipay/agent-payment@1.0.0 dist.integrity
npm install @alipay/agent-payment@1.0.0 && npx @alipay/agent-payment@1.0.0 install-cli
which alipay-bot && alipay-bot --version

Technical Analysis

The Skill instructs the agent to download and execute @alipay/agent-payment@1.0.0, but the dependency's implementation is not included in the audited project. As a result, its installation scripts, install-cli behavior, generated files, network destinations, and runtime handling of payment data cannot be verified from this artifact.

Pinning the package version and validating dist.integrity are useful safeguards against unintended package substitution. However, integrity verification only proves that the downloaded archive matches the archive published under that version; it does not establish that the archive itself is safe. Both npm install lifecycle scripts and the subsequent npx ... install-cli command can execute package-controlled code with the permissions of the agent process.

The installed CLI is subsequently entrusted with payment links, session identifiers, order summaries, payment-state requests, optional model and operating-system metadata, and user-approved problem reports. This creates a material trust boundary around an unaudited executable dependency.

Attack Path

1. A payment-related request activates the Skill.
2. The required alipay-bot executable is not present.
3. After user approval and integrity comparison, the agent runs npm install.
4. npm may execute package-defined installation lifecycle scripts.
5. The agent then runs the package-controlled install-cli entry point through npx.
6. Package code executes with the filesystem, process, environme ...[truncated 939 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the executable dependency's source code, build inputs, and lockfile in the review scope.
2. Audit all npm lifecycle scripts and the install-cli entry point before deployment.
3. Where feasible, install with lifecycle scripts disabled and invoke only a separately verified binary.
4. Verify the final installed CLI artifact against a published cryptographic digest, not only the npm archive integrity value.
5. Document every file created or modified by install-cli and all network endpoints contacted by the CLI.
6. Run installation and payment operations in a least-privilege sandbox with a restricted filesystem and an explicit outbound-network allowlist.
7. Avoid exposing unrelated environment variables, credentials, conversation history, or host files to the dependency.
8. Maintain a reviewed software bill of materials and continuously monitor the pinned package for security advisories.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:399

Finding

Shell Command Injection Through an Insufficiently Escaped Payment URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:399-426
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code Snippet:

bash

alipay-bot submit-payment --payment-link '<cashier-link>'

The session-aware variant uses the same vulnerable interpolation pattern:

bash

AIPAY_SESSION_ID=<uuid> AIPAY_FRAMEWORK=openclaw alipay-bot submit-payment --payment-link '<cashier-link>' --session-id <sessionId>

Technical Analysis

The Skill directs the agent to interpolate a payment URL obtained from conversation or tool output into a shell command enclosed by single quotes. Its documented validation checks the HTTPS scheme, Alipay cashier-domain pattern, URL path, source, and query completeness, but it does not require rejection or escaping of a literal apostrophe.

In a POSIX shell, an apostrophe terminates a single-quoted argument. An attacker-controlled URL containing an apostrophe can therefore leave the quoted URL context and append shell operators or another command. URL/domain validation alone does not provide shell safety because parsing the URL and parsing the resulting shell command are separate operations.

The document demonstrates awareness of this principle elsewhere: the problem-feedback --reason flow explicitly requires apostrophes to be replaced with a shell-safe sequence. Equivalent handling is not specified for --payment-link, despite that parameter also containing externally sourced text.

Attack Path

1. An attacker places a crafted Alipay cashier URL in the conversation or in the output of another tool.
2. The URL begins with HTTPS and is structured to satisfy the documented cashier-domain and path checks.
3. The URL contains a literal apostrophe followed by shell syntax and an attacker-selected command.
4. The agent substitutes the value into the documented single-quoted submit-payment command.
5. The apostrophe closes th ...[truncated 1292 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct a shell command by concatenating or interpolating the payment URL.
2. Invoke alipay-bot through an execution API that accepts an argument array, for example:

   text

   ["alipay-bot", "submit-payment", "--payment-link", validatedUrl]
   

3. Configure the execution API to bypass shell interpretation entirely.
4. Apply URL parsing with exact hostname checks after normalization. Do not rely on substring or loosely defined wildcard matching.
5. Require HTTPS and reject embedded credentials, control characters, null bytes, whitespace ambiguities, and unexpected URL schemes.
6. If a shell is unavoidable, use a proven shell-escaping routine for every dynamic argument and explicitly reject apostrophes and line breaks as defense in depth.
7. Apply the same safe argument handling to session identifiers, framework values, channel metadata, order summaries, and feedback reasons.
8. Add automated tests containing apostrophes, semicolons, command substitutions, line breaks, encoded delimiters, and malformed hostnames.
9. Run the payment CLI in a least-privilege sandbox to limit the impact of any command-execution defect.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s trigger conditions and keyword list are broad enough to activate on generic mentions of paying, checkout, or Alipay, even when the user is only discussing payment rather than explicitly authorizing a real transaction. In a payment skill, over-triggering is dangerous because it can prematurely steer the agent into a sensitive payment workflow, increasing the risk of unintended payment actions or exposing users to payment-link handling without sufficiently clear intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.