registry / alipay-subscription-skill / 1.4.0

alipay-subscription-skill@1.4.0

Claude Code skill — 支付宝订阅产品商家接入指南（安装后自动放入 ~/.claude/skills）

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 15.5 KB of source, external domains: www.npmjs.com

Source & flagged code

9 flagged

package.jsonView file

Lines 1-38json

2 "name": "alipay-subscription-skill",

3 "version": "1.4.0",

4 "description": "Claude Code skill — 支付宝订阅产品商家接入指南（安装后自动放入 ~/.claude/skills）",

5 "type": "module",

6 "bin": {

7 "alipay-subscription-skill": "scripts/install.mjs"

8 },

9 "files": [

10 "SKILL.md",

11 "references",

12 "scripts",

13 "LICENSE"

14 ],

15 "scripts": {

16 "setup": "node scripts/install.mjs",

17 "release": "node scripts/release.mjs",

18 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "postuninstall": "node scripts/uninstall.mjs"

20 },

21 "keywords": [

22 "claude",

23 "claude-code",

24 "skill",

25 "alipay",

26 "subscription",

27 "支付宝",

28 "订阅"

29 ],

30 "author": "dongrunze <dongrunze.drz@antgroup.com>",

31 "license": "MIT",

32 "engines": {

33 "node": ">=18"

34 },

35 "repository": {

36 "type": "git",

37 "url": "git@code.alipay.com:token_pay/subscription_skill.git"

38 },

scripts/release.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// 一键发布：bump 版本 → 同步 SKILL.md frontmatter → git commit/tag/push → npm publish

3// 用法: npm run release -- [--patch|--minor|--major|<version>] [--dry-run]

4// 默认 patch。仅依赖 node 内置模块。

6import { execSync } from 'node:child_process';

7import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/release.mjsView on unpkg · L5

scripts/install.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// 交互式安装器（bin 入口）。

3// 流程：① 确保已全局安装本包 ② 让用户多选目标（Claude Code / Codex）③ 复制 skill 到所选目录。

4// 同时也是 npx 入口：npx alipay-subscription-skill 即可运行。

5// 仅依赖 node 内置模块。

7import { execSync, spawnSync } from 'node:child_process';

8import fs from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install.mjs

references/code-example-java.mdView file

Lines 148-189markdown

148

149 // 2. 使用私钥签名

150 PrivateKey key = parsePrivateKey(privateKeyPem);

151 Signature signature = Signature.getInstance(SIGN_ALGORITHM);

152 signature.initSign(key);

153 signature.update(signContent.getBytes("UTF-8"));

154 byte[] signBytes = signature.sign();

155

156 // 3. Base64编码

157 return Base64.getEncoder().encodeToString(signBytes);

158 } catch (Exception e) {

159 throw new RuntimeException("生成签名失败: " + e.getMessage(), e);

references/quickstart.mdView file

Lines 12-52markdown

12> 如未完成前置条件，请先参考 [merchant-onboarding.md](merchant-onboarding.md)

14---

16## 第一步：准备配置

18### 1.1 获取密钥

20从支付宝开放平台获取：

21- AppID

22- 商户私钥（本地生成）

23- 支付宝公钥（平台获取）

references/code-example-go.mdView file

Lines 229-251markdown

229 app_id: "2021008156661106"

230 private_key: |

231 MIIEvwIBADANBgkqhkiG9w0BAQEFA...

232 alipay_public_key: |

233 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

234 gateway_url: "http://openapi.stable.alipay.net/gateway.do"

235 notify_url: "https://your-domain.com/api/alipay/notify"

236 return_url: "https://your-domain.com/subscription/success"

237 mock_mode: true # 开发时开启，不调用真实 API

238```

239

240## 运行服务

SKILL.mdView file

316patternName = private_key_rsa severity = critical line = 316 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in SKILL.md

SKILL.mdView on unpkg · L316

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/release.mjsView file

5L6: import { execSync } from 'node:child_process'; L7: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/release.mjsView on unpkg · L5

scripts/install.mjsView file

3// 流程：① 确保已全局安装本包 ② 让用户多选目标（Claude Code / Codex）③ 复制 skill 到所选目录。 L4: // 同时也是 npx 入口：npx alipay-subscription-skill 即可运行。 L5: // 仅依赖 node 内置模块。 L6: L7: import { execSync, spawnSync } from 'node:child_process'; L8: import fs from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install.mjsView on unpkg · L3

references/code-example-java.mdView file

168patternName = private_key_rsa severity = critical line = 168 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in references/code-example-java.md

references/code-example-java.mdView on unpkg · L168

169patternName = private_key_rsa severity = critical line = 169 matchedText = .replace... "")

Critical

Secret Pattern

RSA private key in references/code-example-java.md

references/code-example-java.mdView on unpkg · L169

references/quickstart.mdView file

32patternName = private_key_rsa severity = critical line = 32 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in references/quickstart.md

references/quickstart.mdView on unpkg · L32

references/code-example-go.mdView file

249patternName = private_key_rsa severity = critical line = 249 matchedText = 2. **密钥格...` 头部

Critical

Secret Pattern

RSA private key in references/code-example-go.md

references/code-example-go.mdView on unpkg · L249

SKILL.mdView file

316patternName = private_key_rsa severity = critical line = 316 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in SKILL.md

SKILL.mdView on unpkg · L316

Findings

5 Critical4 High3 Medium5 Low

CriticalSecret Patternreferences/code-example-java.md

CriticalSecret Patternreferences/quickstart.md

CriticalSecret Patternreferences/code-example-go.md

CriticalSecret PatternSKILL.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/release.mjs

HighShell

HighRuntime Package Installscripts/install.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 1-38json

2 "name": "alipay-subscription-skill",

3 "version": "1.4.0",

4 "description": "Claude Code skill — 支付宝订阅产品商家接入指南（安装后自动放入 ~/.claude/skills）",

5 "type": "module",

6 "bin": {

7 "alipay-subscription-skill": "scripts/install.mjs"

8 },

9 "files": [

10 "SKILL.md",

11 "references",

12 "scripts",

13 "LICENSE"

14 ],

15 "scripts": {

16 "setup": "node scripts/install.mjs",

17 "release": "node scripts/release.mjs",

18 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "postuninstall": "node scripts/uninstall.mjs"

20 },

21 "keywords": [

22 "claude",

23 "claude-code",

24 "skill",

25 "alipay",

26 "subscription",

27 "支付宝",

28 "订阅"

29 ],

30 "author": "dongrunze <dongrunze.drz@antgroup.com>",

31 "license": "MIT",

32 "engines": {

33 "node": ">=18"

34 },

35 "repository": {

36 "type": "git",

37 "url": "git@code.alipay.com:token_pay/subscription_skill.git"

38 },

scripts/release.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// 一键发布：bump 版本 → 同步 SKILL.md frontmatter → git commit/tag/push → npm publish

3// 用法: npm run release -- [--patch|--minor|--major|<version>] [--dry-run]

4// 默认 patch。仅依赖 node 内置模块。

6import { execSync } from 'node:child_process';

7import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/release.mjsView on unpkg · L5

scripts/install.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// 交互式安装器（bin 入口）。

3// 流程：① 确保已全局安装本包 ② 让用户多选目标（Claude Code / Codex）③ 复制 skill 到所选目录。

4// 同时也是 npx 入口：npx alipay-subscription-skill 即可运行。

5// 仅依赖 node 内置模块。

7import { execSync, spawnSync } from 'node:child_process';

8import fs from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install.mjs

references/code-example-java.mdView file

Lines 148-189markdown

148

149 // 2. 使用私钥签名

150 PrivateKey key = parsePrivateKey(privateKeyPem);

151 Signature signature = Signature.getInstance(SIGN_ALGORITHM);

152 signature.initSign(key);

153 signature.update(signContent.getBytes("UTF-8"));

154 byte[] signBytes = signature.sign();

155

156 // 3. Base64编码

157 return Base64.getEncoder().encodeToString(signBytes);

158 } catch (Exception e) {

159 throw new RuntimeException("生成签名失败: " + e.getMessage(), e);

references/quickstart.mdView file

Lines 12-52markdown

12> 如未完成前置条件，请先参考 [merchant-onboarding.md](merchant-onboarding.md)

14---

16## 第一步：准备配置

18### 1.1 获取密钥

20从支付宝开放平台获取：

21- AppID

22- 商户私钥（本地生成）

23- 支付宝公钥（平台获取）

references/code-example-go.mdView file

Lines 229-251markdown

229 app_id: "2021008156661106"

230 private_key: |

231 MIIEvwIBADANBgkqhkiG9w0BAQEFA...

232 alipay_public_key: |

233 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

234 gateway_url: "http://openapi.stable.alipay.net/gateway.do"

235 notify_url: "https://your-domain.com/api/alipay/notify"

236 return_url: "https://your-domain.com/subscription/success"

237 mock_mode: true # 开发时开启，不调用真实 API

238```

239

240## 运行服务

SKILL.mdView file

316patternName = private_key_rsa severity = critical line = 316 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in SKILL.md

SKILL.mdView on unpkg · L316