Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →doccker/payment-callback-safety
当代码涉及支付回调、webhook 通知、notify_url、微信支付/支付宝回调处理时触发。防止回调伪造、重放攻击、金额篡改等支付安全问题。
Passed 21 of 22 test cases with the skill, and 17 of 22 without it.
and 2 more in the full report
5 fixed16 passed either way0 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
我们团队正在编写微信支付 API v3 的回调处理接口。为了确保资金安全和防攻击，请帮我审查回调逻辑并提供一份标准的 Java 代码范例。请按照处理顺序分步骤说明从接收请求到变更订单状态所需的安全校验要点（涉及验签、重放拦截和业务一致性检查），并给出重构后的 Controller 层代码结构。
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies reusing unified validation logic between callback handling and reconciliation. | Missed | Passed |
| The response requires verifying the signature before decrypting the request payload. | Passed | Passed |
The instructions your model reads when the skill loads.
当系统涉及第三方支付回调（微信支付、支付宝等）或 webhook 通知时，防止伪造、篡改和重放攻击。
场景: 收到支付回调后直接解密/解析并处理，未验证请求确实来自支付平台
支付回调地址暴露在公网，任何人都可以伪造请求。如果不验签，攻击者可以构造假的"支付成功"通知。
// ❌ 错误: 直接解密处理，未验签
@PostMapping("/payment/callback/wechat")
public String wechatCallback(@RequestBody String body) {
JsonNode json = objectMapper.readTree(body);
// 直接尝试解密 resource
String decrypted = decryptAesGcm(ciphertext, apiV3Key, nonce, aad);
processPayment(decrypted); // 谁发来的都处理
return "{\"code\":\"SUCCESS\"}";
}
// ✅ 正确: 先验签，再解密，再处理
@PostMapping("/payment/callback/wechat")
public String wechatCallback(
@RequestBody String body,
@RequestHeader("Wechatpay-Signature") String signature,
@RequestHeader("Wechatpay-Timestamp") String timestamp,
@RequestHeader("Wechatpay-Nonce") String nonce,
test cases passed, vs 17 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.