📦
Historial de auditorías
wind-mcp-skill - 1 auditoría
Versión de auditoría 1 Más reciente
10 sept 2026, 12:37
Most static detections are false positives caused by JavaScript template literals, Markdown backticks, Chinese documentation entropy, and normal configuration access. However, successful calls launch an unattended mutable updater, and the updater forwards the complete environment to npx and git. Command-line API-key handling and unpinned global fallback installation add credential and supply-chain exposure.
15
Archivos escaneados
2,471
Líneas analizadas
11
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (3)
Crítico
scripts/cli.mjs:137-148scripts/cli.mjs:1032-1037scripts/update-check.mjs:78-81scripts/update-check.mjs:397-409scripts/update-check.mjs:428-464
Unattended Mutable Self-Update
Every successful data call can launch a detached updater that runs unpinned npx update or add commands without update-specific confirmation. Remote compromise could replace executable skill code.
The call success path directly schedules the detached updater, which executes npx with approval bypass flags and mutable sources.
Alto
API Key Exposed Through Command Arguments
The setup-key command receives the API key through process arguments. Shell history and process inspection can retain the secret before it is stored.
The code assigns rawArgs[0] directly to the key, and the documented command syntax requires the secret as a positional argument.
Alto
Unpinned Global Fallback Installation
The workflow tells the agent to install wind-alice globally from an unpinned repository with automatic approval. User consent is required, but source integrity is not verified.
The exact npx commands use mutable repository references, global scope, and the noninteractive approval flag without a commit or checksum.
Elementos de revisión de capacidades (4)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Crítico
Process spawn
const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:
This spawn launches a detached updater after successful data calls. The background process can replace skill code without an update-specific user confirmation.
Crítico
Synchronous spawn
const result = spawnSync(bin, args, {
This executes unattended npx update or add commands assembled by the updater. The command can install mutable remote code with the current user privileges.
Crítico
Windows cmd.exe
const bin = isWin ? 'cmd.exe' : 'npx';
On Windows, the unattended update is routed through cmd.exe with a joined command string. Mutable source and skill values are not shell-escaped, adding command-injection exposure.
Alto
Environment variable object
...process.env
The updater copies the complete process environment into git and npx subprocesses. A compromised update tool or dependency could read unrelated host secrets.
Factores de riesgo
⚙️ Comandos externos (50)
scripts/cli.mjs:7 scripts/cli.mjs:146 scripts/cli.mjs:944 scripts/cli.mjs:56 scripts/cli.mjs:57 scripts/cli.mjs:58 scripts/cli.mjs:59 scripts/cli.mjs:60 scripts/cli.mjs:61 scripts/cli.mjs:62 scripts/cli.mjs:63 scripts/cli.mjs:64 scripts/cli.mjs:65 scripts/cli.mjs:66 scripts/cli.mjs:67 scripts/cli.mjs:144 scripts/cli.mjs:160 scripts/cli.mjs:167 scripts/cli.mjs:175 scripts/cli.mjs:278 scripts/cli.mjs:340 scripts/cli.mjs:354 scripts/cli.mjs:357 scripts/cli.mjs:362 scripts/cli.mjs:367 scripts/cli.mjs:376 scripts/cli.mjs:386 scripts/cli.mjs:456 scripts/cli.mjs:486 scripts/cli.mjs:488 scripts/cli.mjs:530 scripts/cli.mjs:535 scripts/cli.mjs:550 scripts/cli.mjs:557 scripts/cli.mjs:563 scripts/cli.mjs:571 scripts/cli.mjs:578 scripts/cli.mjs:583 scripts/cli.mjs:608 scripts/cli.mjs:611 scripts/cli.mjs:644 scripts/cli.mjs:677 scripts/cli.mjs:696 scripts/cli.mjs:781 scripts/cli.mjs:792 scripts/cli.mjs:793 scripts/cli.mjs:794 scripts/cli.mjs:811 scripts/cli.mjs:812 scripts/cli.mjs:813
🌐 Acceso a red (12)
📁 Acceso al sistema de archivos (30)
scripts/cli.mjs:3 scripts/cli.mjs:108 scripts/cli.mjs:118 scripts/cli.mjs:314 scripts/cli.mjs:323 scripts/cli.mjs:348 scripts/cli.mjs:384 scripts/cli.mjs:778 scripts/cli.mjs:905 scripts/cli.mjs:909 scripts/cli.mjs:914 scripts/cli.mjs:977 scripts/cli.mjs:282 scripts/cli.mjs:282 scripts/cli.mjs:423 scripts/cli.mjs:424 scripts/cli.mjs:425 scripts/cli.mjs:426 scripts/cli.mjs:427 scripts/cli.mjs:446 scripts/cli.mjs:732 scripts/cli.mjs:906 scripts/update-check.mjs:10 scripts/update-check.mjs:14 scripts/update-check.mjs:126 scripts/update-check.mjs:261 scripts/update-check.mjs:358 scripts/update-check.mjs:390 scripts/update-check.mjs:159 scripts/update-check.mjs:165
🔑 Variables de entorno (18)
scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:288 scripts/cli.mjs:282 scripts/cli.mjs:315 scripts/cli.mjs:324 scripts/cli.mjs:329 scripts/cli.mjs:332 scripts/cli.mjs:906 scripts/cli.mjs:908 scripts/cli.mjs:914 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175
Auditado por: codex