Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →doccker/cc-payment-callback-safety
支付回调/webhook 安全检查，防止回调伪造、重放攻击和金额篡改。
Passed 22 of 22 test cases with the skill, and 20 of 22 without it.
and 1 more in the full report
2 fixed20 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
请帮我审查这段微信支付 API v3 的回调处理代码。在公网暴露回调端点时，我担心可能存在安全性或者并发重复调用的隐患。请检查代码中的漏洞，并给出符合安全规范的重构后 Java 代码与修补说明。
| Checked | Without skill | With skill |
|---|---|---|
| Validates that callback total amount matches the expected local order amount. | Missed | Passed |
| Uses platform public key verification matching the Wechatpay-Serial header. | Passed | Passed |
| Checks that the callback timestamp is within a 300-second window. | Passed | Passed |
The instructions your model reads when the skill loads.
当系统涉及第三方支付回调（微信支付、支付宝等）或 webhook 通知时，防止伪造、篡改和重放攻击。
场景: 收到支付回调后直接解密/解析并处理，未验证请求确实来自支付平台
支付回调地址暴露在公网，任何人都可以伪造请求。如果不验签，攻击者可以构造假的"支付成功"通知。
// ❌ 错误: 直接解密处理，未验签
@PostMapping("/payment/callback/wechat")
public String wechatCallback(@RequestBody String body) {
JsonNode json = objectMapper.readTree(body);
// 直接尝试解密 resource
String decrypted = decryptAesGcm(ciphertext, apiV3Key, nonce, aad);
processPayment(decrypted); // 谁发来的都处理
return "{\"code\":\"SUCCESS\"}";
}
// ✅ 正确: 先验签，再解密，再处理
@PostMapping("/payment/callback/wechat")
public String wechatCallback(
@RequestBody String body,
@RequestHeader("Wechatpay-Signature") String signature,
@RequestHeader("Wechatpay-Timestamp") String timestamp,
@RequestHeader("Wechatpay-Nonce") String nonce,
@RequestHeader("Wechatpay-Serial") String serial) {
test cases passed, vs 20 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.