監査履歴

Environment file access

const envKey = process.env.WIND_API_KEY?.trim();

The line reads WIND_API_KEY from the process environment. It is not an environment file read, but it is sensitive secret access.

高

Environment file access

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

高

Environment file access

const xdg = process.env.XDG_STATE_HOME;

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

高

README.md:75-78 scripts/cli.mjs:124-135 scripts/update-check.mjs:397-402 scripts/update-check.mjs:428-464

Environment file access

...process.env

The updater forwards the full process environment to child commands. This can expose sensitive environment values to git or npx execution.

高

Automatic Background Update Executes Package Manager

The CLI starts a detached updater after successful data calls. The updater can run npx skills update or add commands and change installed skill files without per-run user confirmation.

The README documents daily automatic updates, and the code spawns update-check before running npx update or add commands. This is a behavior-level supply-chain risk.

機能レビュー項目 (37)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

scripts/cli.mjs:7

Node.js child_process module

import { spawn } from 'node:child_process';

The CLI imports child_process and uses spawn for local updater and browser commands. No direct user-controlled shell was found, but command execution is real.

高

scripts/cli.mjs:133

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

The CLI spawns a detached Node updater from a copied script after successful calls. This can execute update logic without per-run user confirmation.

高

scripts/cli.mjs:494

Generic API/secret keys

const key = env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:503

Generic API/secret keys

const key = typeof cfg.wind_api_key === 'string' ? cfg.wind_api_key.trim() : '';

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

Generic API/secret keys

const envKey = process.env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:808

Generic API/secret keys

.filter(l => l.length > 0 && !/^\s*(export\s+)?WIND_API_KEY\s*=/.test(l));

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:810

Generic API/secret keys

lines.push(`WIND_API_KEY=${key}`);

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/update-check.mjs:21

Generic API/secret keys

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

Node.js child_process module

} from 'node:child_process';

The updater imports child_process for synchronous git and npx execution. That command execution can alter installed skill files.

高

scripts/update-check.mjs:184

Synchronous spawn

const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {

The updater runs git ls-remote against a source URL from lock metadata. Arguments are array-based, but this is real external command and network execution.

高

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

The updater runs npx skills update or add in the background. This package-manager path can modify executable skill content.

高

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows the updater executes a joined command string through cmd.exe. Lock-derived command parts increase shell parsing risk.

高

SKILL.md:9

Node.js child_process module

child_process: true

The skill explicitly declares child_process support, matching executable Node scripts in the package. This is a real permission risk, although not an exploit by itself.

中

scripts/cli.mjs:635

Fetch API call

resp = await fetch(server.endpoint, {

The CLI posts JSON-RPC requests to Wind MCP endpoints with an Authorization bearer token. This is expected, but it sends authenticated data externally.

中

scripts/cli.mjs:493

Synchronous file operations

const env = parseDotenv(readFileSync(globalConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:502

Synchronous file operations

const cfg = JSON.parse(readFileSync(localConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:807

Synchronous file operations

lines = readFileSync(file, 'utf8').split('\n')

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:811

Synchronous file operations

writeFileSync(file, lines.join('\n') + '\n', {

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

Synchronous file operations

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

Environment variable access (dot notation)

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

中

scripts/update-check.mjs:126

Environment variable object

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

中

scripts/cli.mjs:178

dotenv library

// dotenv 解析: 兼容注释 / 引号 / export 前缀

The custom dotenv parser is used to load WIND_API_KEY from local configuration. This is expected, but it handles sensitive credential material.

中

Synchronous file operations

const data = JSON.parse(readFileSync(file, 'utf8'));

The updater reads lock metadata that can influence update source selection. This is expected, but it contributes to supply-chain risk.

中

scripts/update-check.mjs:160

Environment variable object

...process.env

The updater passes the full process environment to git and npx child processes. Any secrets in the environment are forwarded to those commands.

低

scripts/cli.mjs:14

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_stock_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:18

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_fund_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:22

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_index_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:26

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_bond_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:30

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_financial_docs/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:34

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_economic_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:38

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_analytics_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

Hardcoded URL

return `https://github.com/${entry.source}.git`;

The updater constructs a GitHub source URL for update checks. This is expected, but it is part of external update behavior.

低

scripts/update-check.mjs:167

Hardcoded URL

return `https://gitee.com/${entry.source}.git`;

The updater constructs a Gitee source URL for update checks. This is expected, but it is part of external update behavior.

低

Environment variable access (dot notation)

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低

Environment variable access (dot notation)

const xdg = process.env.XDG_STATE_HOME;

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低

Environment variable object

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低

README.md:32 references/fallback-alice.md:42 scripts/cli.mjs:635 scripts/cli.mjs:14 scripts/cli.mjs:18 scripts/cli.mjs:22 scripts/cli.mjs:26 scripts/cli.mjs:30 scripts/cli.mjs:34 scripts/cli.mjs:38 scripts/cli.mjs:43 scripts/update-check.mjs:160 scripts/update-check.mjs:167 SKILL.md:6

Environment variable object

const xdg = process.env.XDG_STATE_HOME;

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

リスク要因

⚙️ 外部コマンド (151)

🌐 ネットワークアクセス (14)

📁 ファイルシステムへのアクセス (31)

🔑 環境変数 (18)

README.md:41 README.md:49 scripts/cli.mjs:508 scripts/cli.mjs:508 scripts/cli.mjs:178 scripts/cli.mjs:494 scripts/cli.mjs:503 scripts/cli.mjs:508 scripts/cli.mjs:511 scripts/cli.mjs:808 scripts/cli.mjs:810 scripts/cli.mjs:816 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175 SKILL.md:46

監査者: codex

監査バージョン 1

2026年7月6日 12:56

スキャンされたファイル

2,806

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (5)

高

Environment file access

const envKey = process.env.WIND_API_KEY?.trim();

The line reads WIND_API_KEY from the process environment. It is not an environment file read, but it is sensitive secret access.

高

Environment file access

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

高

Environment file access

const xdg = process.env.XDG_STATE_HOME;

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

高

README.md:75-78 scripts/cli.mjs:124-135 scripts/update-check.mjs:397-402 scripts/update-check.mjs:428-464

Environment file access

...process.env

The updater forwards the full process environment to child commands. This can expose sensitive environment values to git or npx execution.

高

Automatic Background Update Executes Package Manager

The CLI starts a detached updater after successful data calls. The updater can run npx skills update or add commands and change installed skill files without per-run user confirmation.

The README documents daily automatic updates, and the code spawns update-check before running npx update or add commands. This is a behavior-level supply-chain risk.

機能レビュー項目 (37)

高

scripts/cli.mjs:7

Node.js child_process module

import { spawn } from 'node:child_process';

The CLI imports child_process and uses spawn for local updater and browser commands. No direct user-controlled shell was found, but command execution is real.

高

scripts/cli.mjs:133

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

The CLI spawns a detached Node updater from a copied script after successful calls. This can execute update logic without per-run user confirmation.

高

scripts/cli.mjs:494

Generic API/secret keys

const key = env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:503

Generic API/secret keys

const key = typeof cfg.wind_api_key === 'string' ? cfg.wind_api_key.trim() : '';

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

Generic API/secret keys

const envKey = process.env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:808

Generic API/secret keys

.filter(l => l.length > 0 && !/^\s*(export\s+)?WIND_API_KEY\s*=/.test(l));

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/cli.mjs:810

Generic API/secret keys

lines.push(`WIND_API_KEY=${key}`);

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

scripts/update-check.mjs:21

Generic API/secret keys

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

高

Node.js child_process module

} from 'node:child_process';

The updater imports child_process for synchronous git and npx execution. That command execution can alter installed skill files.

高

scripts/update-check.mjs:184

Synchronous spawn

const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {

The updater runs git ls-remote against a source URL from lock metadata. Arguments are array-based, but this is real external command and network execution.

高

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

The updater runs npx skills update or add in the background. This package-manager path can modify executable skill content.

高

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows the updater executes a joined command string through cmd.exe. Lock-derived command parts increase shell parsing risk.

高

SKILL.md:9

Node.js child_process module

child_process: true

The skill explicitly declares child_process support, matching executable Node scripts in the package. This is a real permission risk, although not an exploit by itself.

中

scripts/cli.mjs:635

Fetch API call

resp = await fetch(server.endpoint, {

The CLI posts JSON-RPC requests to Wind MCP endpoints with an Authorization bearer token. This is expected, but it sends authenticated data externally.

中

scripts/cli.mjs:493

Synchronous file operations

const env = parseDotenv(readFileSync(globalConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:502

Synchronous file operations

const cfg = JSON.parse(readFileSync(localConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:807

Synchronous file operations

lines = readFileSync(file, 'utf8').split('\n')

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

scripts/cli.mjs:811

Synchronous file operations

writeFileSync(file, lines.join('\n') + '\n', {

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

Synchronous file operations

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

中

Environment variable access (dot notation)

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

中

scripts/update-check.mjs:126

Environment variable object

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

中

scripts/cli.mjs:178

dotenv library

// dotenv 解析: 兼容注释 / 引号 / export 前缀

The custom dotenv parser is used to load WIND_API_KEY from local configuration. This is expected, but it handles sensitive credential material.

中

Synchronous file operations

const data = JSON.parse(readFileSync(file, 'utf8'));

The updater reads lock metadata that can influence update source selection. This is expected, but it contributes to supply-chain risk.

中

scripts/update-check.mjs:160

Environment variable object

...process.env

The updater passes the full process environment to git and npx child processes. Any secrets in the environment are forwarded to those commands.

低

scripts/cli.mjs:14

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_stock_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:18

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_fund_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:22

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_index_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:26

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_bond_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:30

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_financial_docs/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:34

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_economic_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

scripts/cli.mjs:38

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_analytics_data/mcp/',

This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.

低

Hardcoded URL

return `https://github.com/${entry.source}.git`;

The updater constructs a GitHub source URL for update checks. This is expected, but it is part of external update behavior.

低

scripts/update-check.mjs:167

Hardcoded URL

return `https://gitee.com/${entry.source}.git`;

The updater constructs a Gitee source URL for update checks. This is expected, but it is part of external update behavior.

低

Environment variable access (dot notation)

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低

Environment variable access (dot notation)

const xdg = process.env.XDG_STATE_HOME;

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低

Environment variable object

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.

低