📦

wind-mcp-skill

Name: wind-mcp-skill
Author: Wind

Révision du contenu r1 Critique ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Query Global Financial Markets with Wind

Financial research requires current, structured data across many asset classes. This skill routes questions to Wind MCP services and validates requests before returning results.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

N’installez pas automatiquement ce Skill.

La politique de référence exige un examen par un opérateur avant toute action d’installation.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "wind-mcp-skill" from https://skillstore.io/skills/wind-alice-wind-mcp-skill.md and its manifest at https://skillstore.io/api/skills/wind-alice-wind-mcp-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/wind-alice-wind-mcp-skill.md manifest signé GET /api/skills/wind-alice-wind-mcp-skill/manifest lockfile signé GET /api/skills/wind-alice-wind-mcp-skill/lockfile

Tester

Utilisation de « wind-mcp-skill ». Show the latest trading data for Kweichow Moutai.

Résultat attendu:

A concise market snapshot with the Wind code, latest price, change, volume, trading time, units, and Wind source statement.

Utilisation de « wind-mcp-skill ». Compare two named funds over the last year.

Résultat attendu:

Side-by-side performance and risk measures with reported dates.
Fund size, manager, and major holding details when available.
Clear notes for missing fields, unknown units, or incomplete coverage.

Utilisation de « wind-mcp-skill ». Retrieve ten years of a Chinese economic indicator.

Résultat attendu:

A dated time series with indicator identity, frequency, unit, magnitude, source, and any service limitations.

Audit de sécurité

Critique

v1 • 10/09/2026 Ouvrir le rapport versionné

Most static detections are false positives caused by JavaScript template literals, Markdown backticks, Chinese documentation entropy, and normal configuration access. However, successful calls launch an unattended mutable updater, and the updater forwards the complete environment to npx and git. Command-line API-key handling and unpinned global fallback installation add credential and supply-chain exposure.

Fichiers analysés

2,471

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

Critique

scripts/cli.mjs:137-148 scripts/cli.mjs:1032-1037 scripts/update-check.mjs:78-81 scripts/update-check.mjs:397-409 scripts/update-check.mjs:428-464

Unattended Mutable Self-Update

Every successful data call can launch a detached updater that runs unpinned npx update or add commands without update-specific confirmation. Remote compromise could replace executable skill code.

The call success path directly schedules the detached updater, which executes npx with approval bypass flags and mutable sources.

Élevé

scripts/cli.mjs:859-865

API Key Exposed Through Command Arguments

The setup-key command receives the API key through process arguments. Shell history and process inspection can retain the secret before it is stored.

The code assigns rawArgs[0] directly to the key, and the documented command syntax requires the secret as a positional argument.

Élevé

SKILL.md:111

Unpinned Global Fallback Installation

The workflow tells the agent to install wind-alice globally from an unpinned repository with automatic approval. User consent is required, but source integrity is not verified.

The exact npx commands use mutable repository references, global scope, and the noninteractive approval flag without a commit or checksum.

Éléments d’évaluation des capacités (4)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Critique

scripts/cli.mjs:146

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

This spawn launches a detached updater after successful data calls. The background process can replace skill code without an update-specific user confirmation.

Critique

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

This executes unattended npx update or add commands assembled by the updater. The command can install mutable remote code with the current user privileges.

Critique

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows, the unattended update is routed through cmd.exe with a joined command string. Mutable source and skill values are not shell-escaped, adding command-injection exposure.

Élevé

scripts/update-check.mjs:175

Environment variable object

...process.env

The updater copies the complete process environment into git and npx subprocesses. A compromised update tool or dependency could read unrelated host secrets.

Facteurs de risque

⚙️ Commandes externes (50)

scripts/cli.mjs:7 scripts/cli.mjs:146 scripts/cli.mjs:944 scripts/cli.mjs:56 scripts/cli.mjs:57 scripts/cli.mjs:58 scripts/cli.mjs:59 scripts/cli.mjs:60 scripts/cli.mjs:61 scripts/cli.mjs:62 scripts/cli.mjs:63 scripts/cli.mjs:64 scripts/cli.mjs:65 scripts/cli.mjs:66 scripts/cli.mjs:67 scripts/cli.mjs:144 scripts/cli.mjs:160 scripts/cli.mjs:167 scripts/cli.mjs:175 scripts/cli.mjs:278 scripts/cli.mjs:340 scripts/cli.mjs:354 scripts/cli.mjs:357 scripts/cli.mjs:362 scripts/cli.mjs:367 scripts/cli.mjs:376 scripts/cli.mjs:386 scripts/cli.mjs:456 scripts/cli.mjs:486 scripts/cli.mjs:488 scripts/cli.mjs:530 scripts/cli.mjs:535 scripts/cli.mjs:550 scripts/cli.mjs:557 scripts/cli.mjs:563 scripts/cli.mjs:571 scripts/cli.mjs:578 scripts/cli.mjs:583 scripts/cli.mjs:608 scripts/cli.mjs:611 scripts/cli.mjs:644 scripts/cli.mjs:677 scripts/cli.mjs:696 scripts/cli.mjs:781 scripts/cli.mjs:792 scripts/cli.mjs:793 scripts/cli.mjs:794 scripts/cli.mjs:811 scripts/cli.mjs:812 scripts/cli.mjs:813

🌐 Accès réseau (12)

scripts/cli.mjs:15 scripts/cli.mjs:19 scripts/cli.mjs:23 scripts/cli.mjs:27 scripts/cli.mjs:31 scripts/cli.mjs:35 scripts/cli.mjs:39 scripts/cli.mjs:44 scripts/update-check.mjs:160 scripts/update-check.mjs:167 SKILL.md:6 SKILL.md:111

📁 Accès au système de fichiers (30)

🔑 Variables d’environnement (18)

scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:288 scripts/cli.mjs:282 scripts/cli.mjs:315 scripts/cli.mjs:324 scripts/cli.mjs:329 scripts/cli.mjs:332 scripts/cli.mjs:906 scripts/cli.mjs:908 scripts/cli.mjs:914 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg)](https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/wind-alice-wind-mcp-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

Wind. (2026). wind-mcp-skill security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1

Citation BibTeX

@techreport{wind-wind-alice-wind-mcp-skill-2026,
  author = {Wind},
  title = {wind-mcp-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wind-mcp-skill security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "Wind"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:wind-alice-wind-mcp-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparer les variantes

2 variantes installables

Chaque auteur reste un skill installable distinct. La variante recommandée est classée selon les preuves Skillstore.

Pourquoi cette variante est première

Confiance des preuves plus forte

Auteur / source Score Skillstore Niveau de confiance des preuves Utilisation Skillstore Mis à jour

Wind Recommandé

wind-information-co-ltd-wind-mcp-skill

Score Skillstore 38

Niveau de confiance des preuves Moyen

Utilisation Skillstore 33

Mis à jour

2026-09-09

Wind Actuelle

wind-alice-wind-mcp-skill

Score Skillstore 38

Niveau de confiance des preuves Faible

Utilisation Skillstore 8

Mis à jour

2026-10-06

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Faible

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Screen Investment Candidates

Filter stocks or funds by market, size, performance, valuation, and other supported criteria.

Build Market Research

Collect quotes, fundamentals, disclosures, news, and economic series for evidence-based reports.

Validate Portfolio Data

Compare holdings, performance, risk metrics, and index indicators using structured Wind responses.

Essayez ces prompts

Get a Current Quote

Get the latest price, change, volume, and trading time for [security name or Wind code].

Screen a Market

Screen [market] stocks for [criteria]. Return matching names, Wind codes, requested metrics, and data dates.

Compare Funds

Compare [fund list] by one-year performance, volatility, drawdown, size, manager, and major holdings. Preserve returned units and dates.

Combine Market and Economic Evidence

Analyze [topic] using relevant securities, disclosures, news, and economic indicators from [date range]. Separate returned facts from calculations and state limitations.

Bonnes pratiques

Use exact security names or Wind codes and specify the desired date range.
Request only necessary fields and preserve units, magnitude, and timestamps from Wind metadata.
Start batch work with one probe request and stop on authentication, quota, or backend errors.

Éviter

Do not infer missing values, exchange suffixes, units, or financial conclusions.
Do not use broad analytics tools when a dedicated asset-domain tool supports the request.
Do not place API keys in shared prompts, logs, repositories, or command histories.