安全扫描
OpenClaw
安全
medium confidenceThe skill and its files are internally consistent with a feedback-only Alipay CLI helper — it asks only for npm (to install an official CLI), does not request credentials, and its instructions match the described purpose, though installing and running the CLI requires trust in the upstream package and its install behavior.
评估建议
This skill appears coherent for its stated purpose, but it requires installing and running an Alipay-provided CLI. Before installing, review the upstream npm package (@alipay/agent-payment@1.0.0) and the behavior of its `install-cli` command (it may download or install additional components). Avoid including any sensitive credentials or PII in the `--reason` text (the skill promises anonymity, but the CLI output will be forwarded verbatim). If you want stronger assurance, run the provided instal...详细分析 ▾
✓ 用途与能力
Name, description, and required binaries (npm) align: the skill's stated purpose is to submit feedback via an Alipay CLI. Requiring npm to install an alipay CLI is proportionate. No unrelated env vars, binaries, or config paths are requested.
ℹ 指令范围
SKILL.md constrains behavior to collecting a user-provided --reason and calling `alipay-bot problem-feedback --reason "..."`. It explicitly forbids reading external files and claims only to send data to *.alipay.com. However the instructions also require the agent to output CLI responses verbatim, which could surface anything the CLI prints. The skill does include defensive guidance to stop if the CLI requests unexpected permissions or returns unexpected content.
ℹ 安装机制
No platform install spec in registry, but a bundled install script fetches a pinned npm package (@alipay/agent-payment@1.0.0) and verifies metadata (dist.integrity and a maintainer string) before installing. Using npm and a pinned package is reasonable; the script uses `--ignore-scripts` (reduces risk) but then runs the package's `agent-payment install-cli` binary, which may download or install additional files. This is a moderate-risk network install that requires trusting the upstream package.
✓ 凭证需求
The skill requests no user credentials or config paths. The only environment inputs used in the install script are internal (expected integrity/maintainer) and not required from the user. No extraneous secrets or unrelated service tokens are requested.
✓ 持久化与权限
always is false and the skill is user-invocable. It does not request permanent presence or attempt to modify other skills or system-wide configurations. Autonomous invocation is allowed by default but not combined with other red flags here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install alipay-payment-feedback-bk
镜像加速npx clawhub@latest install alipay-payment-feedback-bk --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
alipay-payment-feedback 安装说明： 安装命令：["openclaw skills install alipay-payment-feedback-bk","npx clawhub@latest install alipay-payment-feedback-bk"] 该技能用于支付宝相关操作，可能需要相应的平台账号或API密钥