registry / alipay-subscription-skill / 1.6.2

alipay-subscription-skill@1.6.2

面向商家与服务商的支付宝订阅、自动续费和单笔支付接入 Skill，支持 Claude Code 和 Codex

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 15.5 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "alipay-subscription-skill",

3 "version": "1.6.2",

4 "description": "面向商家与服务商的支付宝订阅、自动续费和单笔支付接入 Skill，支持 Claude Code 和 Codex",

5 "type": "module",

6 "bin": {

7 "alipay-subscription-skill": "scripts/cli.mjs"

8 },

9 "files": [

10 "SKILL.md",

11 "references",

12 "scripts/cli.mjs",

13 "scripts/install.mjs",

14 "scripts/postinstall.mjs",

15 "scripts/uninstall.mjs",

16 "LICENSE"

17 ],

18 "scripts": {

19 "setup": "node scripts/install.mjs",

20 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "postuninstall": "node scripts/uninstall.mjs"

22 },

23 "keywords": [

24 "claude",

25 "claude-code",

26 "skill",

27 "alipay",

28 "subscription",

29 "支付宝",

30 "订阅"

31 ],

32 "author": "Alipay Subscription Skill Contributors",

33 "license": "MIT",

34 "engines": {

35 "node": ">=18"

36 }

37}

references/code-example-java.mdView file

Lines 148-189markdown

148

149 // 2. 使用私钥签名

150 PrivateKey key = parsePrivateKey(privateKeyPem);

151 Signature signature = Signature.getInstance(SIGN_ALGORITHM);

152 signature.initSign(key);

153 signature.update(signContent.getBytes("UTF-8"));

154 byte[] signBytes = signature.sign();

155

156 // 3. Base64编码

157 return Base64.getEncoder().encodeToString(signBytes);

158 } catch (Exception e) {

references/code-example-go.mdView file

Lines 227-250markdown

227

228alipay:

229 app_id: "YOUR_APP_ID"

230 private_key: "YOUR_APP_PRIVATE_KEY"

231 alipay_public_key: "YOUR_ALIPAY_PUBLIC_KEY"

232 gateway_url: "https://openapi.alipay.com/gateway.do"

233 notify_url: "https://your-domain.com/api/alipay/notify"

234 return_url: "https://your-domain.com/subscription/success"

235 mock_mode: false # 生产环境验证调用真实 API

236```

237

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code