Skills/npm/agent

agent@1.0.0

VERIFIED

Publisher claims: "Oceanpayment 跨境支付平台技术对接 Agent Skill —— 帮助 AI 编码代理准确完成 Oceanpayment 支付/订单/订阅/OPCard/OPCCOUNT 等接口集成。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher oceanpayment · joined 0 days agoInstalls 0Last detonated 1 h ago
$claude mcp add agent -- npx -y @oceanpayment/agent
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 93/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

LOW
Prompt injectionskills/oceanpayment/references/current/resource/state-code.md:518 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

No other findings across 16,989 lines in 80 files.

Cost to the agent

Instructions loaded
≈1,276 tok
1 file · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

agent@1.0.0 safety verdict: Verified 93/100 — KillerSkills