📦

wind-mcp-skill

Name: wind-mcp-skill
Author: Wind

Revisión del contenido r1 Crítico ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Query Global Financial Markets with Wind

Financial research requires current, structured data across many asset classes. This skill routes questions to Wind MCP services and validates requests before returning results.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

No instales este Skill automáticamente.

La política canónica exige la revisión de un operador antes de cualquier acción de instalación.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "wind-mcp-skill" from https://skillstore.io/skills/wind-alice-wind-mcp-skill.md and its manifest at https://skillstore.io/api/skills/wind-alice-wind-mcp-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/wind-alice-wind-mcp-skill.md Manifest firmado GET /api/skills/wind-alice-wind-mcp-skill/manifest Lockfile firmado GET /api/skills/wind-alice-wind-mcp-skill/lockfile

Pruébalo

Usando "wind-mcp-skill". Show the latest trading data for Kweichow Moutai.

Resultado esperado:

A concise market snapshot with the Wind code, latest price, change, volume, trading time, units, and Wind source statement.

Usando "wind-mcp-skill". Compare two named funds over the last year.

Resultado esperado:

Side-by-side performance and risk measures with reported dates.
Fund size, manager, and major holding details when available.
Clear notes for missing fields, unknown units, or incomplete coverage.

Usando "wind-mcp-skill". Retrieve ten years of a Chinese economic indicator.

Resultado esperado:

A dated time series with indicator identity, frequency, unit, magnitude, source, and any service limitations.

Auditoría de seguridad

Crítico

v1 • 10/9/2026 Abrir el informe versionado

Most static detections are false positives caused by JavaScript template literals, Markdown backticks, Chinese documentation entropy, and normal configuration access. However, successful calls launch an unattended mutable updater, and the updater forwards the complete environment to npx and git. Command-line API-key handling and unpinned global fallback installation add credential and supply-chain exposure.

Archivos escaneados

2,471

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Crítico

scripts/cli.mjs:137-148 scripts/cli.mjs:1032-1037 scripts/update-check.mjs:78-81 scripts/update-check.mjs:397-409 scripts/update-check.mjs:428-464

Unattended Mutable Self-Update

Every successful data call can launch a detached updater that runs unpinned npx update or add commands without update-specific confirmation. Remote compromise could replace executable skill code.

The call success path directly schedules the detached updater, which executes npx with approval bypass flags and mutable sources.

Alto

scripts/cli.mjs:859-865

API Key Exposed Through Command Arguments

The setup-key command receives the API key through process arguments. Shell history and process inspection can retain the secret before it is stored.

The code assigns rawArgs[0] directly to the key, and the documented command syntax requires the secret as a positional argument.

Alto

SKILL.md:111

Unpinned Global Fallback Installation

The workflow tells the agent to install wind-alice globally from an unpinned repository with automatic approval. User consent is required, but source integrity is not verified.

The exact npx commands use mutable repository references, global scope, and the noninteractive approval flag without a commit or checksum.

Elementos de revisión de capacidades (4)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Crítico

scripts/cli.mjs:146

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

This spawn launches a detached updater after successful data calls. The background process can replace skill code without an update-specific user confirmation.

Crítico

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

This executes unattended npx update or add commands assembled by the updater. The command can install mutable remote code with the current user privileges.

Crítico

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows, the unattended update is routed through cmd.exe with a joined command string. Mutable source and skill values are not shell-escaped, adding command-injection exposure.

Alto

scripts/update-check.mjs:175

Environment variable object

...process.env

The updater copies the complete process environment into git and npx subprocesses. A compromised update tool or dependency could read unrelated host secrets.

Factores de riesgo

⚙️ Comandos externos (50)

scripts/cli.mjs:7 scripts/cli.mjs:146 scripts/cli.mjs:944 scripts/cli.mjs:56 scripts/cli.mjs:57 scripts/cli.mjs:58 scripts/cli.mjs:59 scripts/cli.mjs:60 scripts/cli.mjs:61 scripts/cli.mjs:62 scripts/cli.mjs:63 scripts/cli.mjs:64 scripts/cli.mjs:65 scripts/cli.mjs:66 scripts/cli.mjs:67 scripts/cli.mjs:144 scripts/cli.mjs:160 scripts/cli.mjs:167 scripts/cli.mjs:175 scripts/cli.mjs:278 scripts/cli.mjs:340 scripts/cli.mjs:354 scripts/cli.mjs:357 scripts/cli.mjs:362 scripts/cli.mjs:367 scripts/cli.mjs:376 scripts/cli.mjs:386 scripts/cli.mjs:456 scripts/cli.mjs:486 scripts/cli.mjs:488 scripts/cli.mjs:530 scripts/cli.mjs:535 scripts/cli.mjs:550 scripts/cli.mjs:557 scripts/cli.mjs:563 scripts/cli.mjs:571 scripts/cli.mjs:578 scripts/cli.mjs:583 scripts/cli.mjs:608 scripts/cli.mjs:611 scripts/cli.mjs:644 scripts/cli.mjs:677 scripts/cli.mjs:696 scripts/cli.mjs:781 scripts/cli.mjs:792 scripts/cli.mjs:793 scripts/cli.mjs:794 scripts/cli.mjs:811 scripts/cli.mjs:812 scripts/cli.mjs:813

🌐 Acceso a red (12)

scripts/cli.mjs:15 scripts/cli.mjs:19 scripts/cli.mjs:23 scripts/cli.mjs:27 scripts/cli.mjs:31 scripts/cli.mjs:35 scripts/cli.mjs:39 scripts/cli.mjs:44 scripts/update-check.mjs:160 scripts/update-check.mjs:167 SKILL.md:6 SKILL.md:111

📁 Acceso al sistema de archivos (30)

🔑 Variables de entorno (18)

scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:288 scripts/cli.mjs:282 scripts/cli.mjs:315 scripts/cli.mjs:324 scripts/cli.mjs:329 scripts/cli.mjs:332 scripts/cli.mjs:906 scripts/cli.mjs:908 scripts/cli.mjs:914 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg)](https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/wind-alice-wind-mcp-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

Wind. (2026). wind-mcp-skill security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1

Cita BibTeX

@techreport{wind-wind-alice-wind-mcp-skill-2026,
  author = {Wind},
  title = {wind-mcp-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wind-mcp-skill security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "Wind"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:wind-alice-wind-mcp-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparar variantes

2 variantes instalables

Cada autor sigue siendo un skill instalable independiente. La variante recomendada se ordena según la evidencia de Skillstore.

Por qué esta variante es la primera

Mayor confianza en la evidencia

Autor / fuente Puntuación de Skillstore Confianza de la evidencia Uso en Skillstore Actualizado

Wind Recomendado

wind-information-co-ltd-wind-mcp-skill

Puntuación de Skillstore 38

Confianza de la evidencia Medio

Uso en Skillstore 26

Actualizado

2026-09-09

Wind Actual

wind-alice-wind-mcp-skill

Puntuación de Skillstore 38

Confianza de la evidencia Bajo

Uso en Skillstore 2

Actualizado

2026-09-11

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Bajo

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Screen Investment Candidates

Filter stocks or funds by market, size, performance, valuation, and other supported criteria.

Build Market Research

Collect quotes, fundamentals, disclosures, news, and economic series for evidence-based reports.

Validate Portfolio Data

Compare holdings, performance, risk metrics, and index indicators using structured Wind responses.

Prueba estos prompts

Get a Current Quote

Get the latest price, change, volume, and trading time for [security name or Wind code].

Screen a Market

Screen [market] stocks for [criteria]. Return matching names, Wind codes, requested metrics, and data dates.

Compare Funds

Compare [fund list] by one-year performance, volatility, drawdown, size, manager, and major holdings. Preserve returned units and dates.

Combine Market and Economic Evidence

Analyze [topic] using relevant securities, disclosures, news, and economic indicators from [date range]. Separate returned facts from calculations and state limitations.

Mejores prácticas

Use exact security names or Wind codes and specify the desired date range.
Request only necessary fields and preserve units, magnitude, and timestamps from Wind metadata.
Start batch work with one probe request and stop on authentication, quota, or backend errors.

Evitar

Do not infer missing values, exchange suffixes, units, or financial conclusions.
Do not use broad analytics tools when a dedicated asset-domain tool supports the request.
Do not place API keys in shared prompts, logs, repositories, or command histories.