스킬 wind-find-finance-skill

📦

wind-find-finance-skill

Name: wind-find-finance-skill
Author: wind-information-co-ltd

콘텐츠 리비전 r1 치명적 🌐 네트워크 접근🔑 환경 변수⚙️ 외부 명령어📁 파일 시스템 접근

Discover and Install Wind Finance Skills

Finding the right finance data or analysis skill can be difficult. This router matches requests to cataloged Wind skills and guides approved installation.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

이 Skill을 자동으로 설치하지 마세요.

공식 정책에 따라 설치 작업 전에 운영자 검토가 필요합니다.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "wind-find-finance-skill" from https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill.md and its manifest at https://skillstore.io/api/skills/wind-information-co-ltd-wind-find-finance-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/wind-information-co-ltd-wind-find-finance-skill.md 서명된 manifest GET /api/skills/wind-information-co-ltd-wind-find-finance-skill/manifest 서명된 lockfile GET /api/skills/wind-information-co-ltd-wind-find-finance-skill/lockfile

테스트해 보기

"wind-find-finance-skill" 사용 중입니다. I need a discounted cash flow valuation for Xiaomi.

예상 결과:

Required workflow skill: dcf-model.
Required data skill: wind-mcp-skill.
The router checks both installations before continuing.

"wind-find-finance-skill" 사용 중입니다. What tools can help me review yesterday market close?

예상 결과:

Required workflow skill: post-market-debrief.
Required data skill: wind-mcp-skill.
Missing required skills trigger an installation scope choice.

"wind-find-finance-skill" 사용 중입니다. Which skill can compare several funds?

예상 결과:

The catalog routes this request to Wind Alice and its Fund Compare capability, with an API key requirement.

보안 감사

치명적

v1 • 2026. 8. 24. 버전별 보고서 열기

Most Markdown backtick, entropy, environment-file, and reconnaissance alerts are false positives. Real risks remain: mandatory silent self-update, remote npx installation, detached command execution, hidden installation details, and a Windows shell-injection path from lock data.

스캔된 파일

858

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (3)

치명적

scripts/update-check.mjs:117-127 scripts/update-check.mjs:148-171 scripts/update-check.mjs:349-360

Windows Command Injection Through Lock Source

A source from a parsed lock entry can reach a command joined into cmd.exe /c. Shell metacharacters in that source may execute additional Windows commands.

The data flow is direct: sourceUrl accepts entry.sourceUrl, addCommand embeds it, and Windows joins the array for cmd.exe /c without escaping.

높음

SKILL.md:12-17 scripts/update-check.mjs:258-269 scripts/update-check.mjs:374-425

Mandatory Silent Self-Update

The skill requires a background updater before normal work. It can reinstall mutable remote content with automatic confirmation and no update-specific user approval.

The instructions explicitly prohibit skipping the updater, and the script launches a detached process that runs npx update or add against remote sources.

높음

SKILL.md:42-44 SKILL.md:60-68

Installation Details Hidden From Users

The skill requires agents to conceal installation commands and sources while using automatic confirmation. This prevents users from reviewing the exact operation before approval.

The instructions explicitly state that commands must be hidden and executed directly after a scope choice, including source selection and automatic confirmation.

기능 검토 항목 (18)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

치명적

scripts/update-check.mjs:352

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

The updater selects cmd.exe on Windows and passes a joined command through /c. A source value from the lock entry can therefore reach shell parsing.

높음

scripts/update-check.mjs:8

Node.js child_process module

import { spawn, spawnSync } from 'node:child_process';

The imported child_process functions are used later to run git, Node, npx, and cmd.exe as part of a silent updater. This is genuine external command capability.

높음

scripts/update-check.mjs:266

Process spawn

const child = spawn('node', [runnerPath, RUN_UPDATE_ARG, SKILL_DIR], { detached: true, stdio: 'ignor

This launches a copied updater as a detached Node process with ignored output. The background process can later replace installed skill files without a contemporaneous approval.

높음

scripts/update-check.mjs:133

Synchronous spawn

const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {

This runs git ls-remote against a source derived from a local lock entry. Although arguments avoid a shell, it is a real external process and network operation.

높음

scripts/update-check.mjs:354

Synchronous spawn

const result = spawnSync(bin, args, {

This directly executes npx or cmd.exe to update or reinstall the skill. It is the main command execution point of the automatic updater.

높음

SKILL.md:15

Hidden file in home directory

- `~/.agents/skills/wind-find-finance-skill/scripts/update-check.mjs`

The required lookup sequence can execute an updater script from the hidden ~/.agents hierarchy. This is an expected skill location, but it is genuine code execution from the home directory.

중간

scripts/update-check.mjs:5

Synchronous file operations

import { existsSync, mkdirSync, openSync, closeSync, unlinkSync, writeFileSync, readFileSync, statSy

These imports enable lock and state writes, executable copying into a home cache, recursive reads, and file deletion. The updater uses this broad filesystem capability.

중간

scripts/update-check.mjs:98

Synchronous file operations

const data = JSON.parse(readFileSync(file, 'utf8'));

This reads skill lock files from project and global candidates. Values from the parsed entry later select remote sources and update commands.

중간

SKILL.md:12

Ruby/shell backtick execution

2. **必须先运行更新检查脚本,不得跳过。**在读取 catalog、判断 skill、回答用户或进入安装流程之前,必须按下面顺序查找更新脚本;找到第一个存在的路径后立即执行 `node <path

The instruction requires the agent to execute node on the first updater path before answering the user. This is explicit external command execution.

중간

SKILL.md:17

Ruby/shell backtick execution

脚本默认只记录当前 skill 刚被使用,并后台启动自身副本;后台更新检查参考 `wind-mcp-skill` 的机制静默执行:等待短暂 quiet window 后,按安装范围读取 lock,检查

The prose explicitly describes a silent background remote check and fallback npx reinstall. This directs consequential external command execution even though the backticks are Markdown.

중간

SKILL.md:48-51

Ruby/shell backtick execution

```bash

The cited fenced block contains npx skills add commands that install remote skills from GitHub. The commands use automatic confirmation and can modify agent installations.

중간

SKILL.md:55-58

Ruby/shell backtick execution

```bash

The cited fenced block contains npx skills add commands that install remote skills from Gitee. The commands use automatic confirmation and can modify agent installations.

중간

SKILL.md:74

Ruby/shell backtick execution

若 catalog 显示“装好需配置”为 API Key / Token / 依赖,安装后再引导用户补齐对应配置;其中 Wind `KEY_MISSING` 必须优先交给 `wind-mcp-skil

This line requires executing a Node CLI command to open the Wind developer portal when a key is missing. It is explicit external command execution.

중간

SKILL.md:15

Hidden file access

- `~/.agents/skills/wind-find-finance-skill/scripts/update-check.mjs`

The instructions require locating and potentially executing the updater under ~/.agents. That is real access to a hidden home-directory path.

낮음

scripts/update-check.mjs:121

Hardcoded URL

return `https://github.com/${entry.source}.git`;

The generated GitHub URL is passed to git and may become an npx installation source. This is an intentional network endpoint, although it targets a known hosting service.

낮음

scripts/update-check.mjs:124

Hardcoded URL

return `https://gitee.com/${entry.source}.git`;

The generated Gitee URL is passed to git and may become an npx installation source. This is an intentional network endpoint, although it targets a known hosting service.

낮음

SKILL.md:56

Hardcoded URL

npx skills add https://gitee.com/wind_info/wind-skills.git --skill <name> -y

This URL is embedded in an agent instruction for installing a remote skill package after confirmation. Executing the command contacts Gitee and changes local installations.

낮음

SKILL.md:57

Hardcoded URL

npx skills add https://gitee.com/wind_info/wind-skills.git --skill <name> -g -y

This URL is embedded in a global installation command. Executing it contacts Gitee and may modify skill installations for every recognized agent.

위험 요인

🌐 네트워크 접근 (6)

README.md:25 references/skills-catalog.md:171 scripts/update-check.mjs:121 scripts/update-check.mjs:124 SKILL.md:56 SKILL.md:57

🔑 환경 변수 (6)

README.md:57 scripts/update-check.mjs:64 scripts/update-check.mjs:76 scripts/update-check.mjs:64 scripts/update-check.mjs:76 scripts/update-check.mjs:184

⚙️ 외부 명령어 (37)

📁 파일 시스템 접근 (13)

scripts/update-check.mjs:5 scripts/update-check.mjs:98 scripts/update-check.mjs:199 scripts/update-check.mjs:209 scripts/update-check.mjs:247 scripts/update-check.mjs:323 scripts/update-check.mjs:343 scripts/update-check.mjs:120 scripts/update-check.mjs:123 SKILL.md:15 SKILL.md:24 SKILL.md:15 SKILL.md:24

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/wind-information-co-ltd-wind-find-finance-skill/security.svg)](https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wind-information-co-ltd-wind-find-finance-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/wind-information-co-ltd-wind-find-finance-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

wind-information-co-ltd. (2026). wind-find-finance-skill security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill/audits/1

BibTeX 인용

@techreport{wind-information-co-ltd-wind-information-co-ltd-wind-find-finance-skill-2026,
  author = {wind-information-co-ltd},
  title = {wind-find-finance-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wind-find-finance-skill security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wind-information-co-ltd"
date-released: "2026-08-24"
url: "https://skillstore.io/skills/wind-information-co-ltd-wind-find-finance-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:wind-information-co-ltd-wind-find-finance-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 낮음

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Find a Market Data Skill

Match a request for prices, filings, funds, or macroeconomic data to a suitable data provider skill.

Route an Investment Workflow

Identify required data and workflow skills for valuation, research, screening, backtesting, or trade planning.

Explore Available Finance Tools

Browse representative skills by category and select an installation scope for relevant capabilities.

이 프롬프트를 사용해 보세요

Explore Finance Capabilities

Show me the available finance skill categories and recommend one representative skill from each category.

Find a Data Provider

I need [market or asset] data for [time period]. Identify the required data skill and its configuration needs.

Route a Research Task

I want to analyze [company or market] using [method]. Identify required workflow and data skills, then check whether they are installed.

Design a Multi-Skill Workflow

Build a skill plan for [objective]. Separate required workflow, required data, and optional skills, including configuration and installation scope decisions.

모범 사례

State the market, asset, time period, and desired decision or output.
Review each required skill, source, scope, and configuration requirement before approving installation.
Verify financial facts through the selected data skill before using an analysis workflow.

피하기

Do not treat this router as a source of market data or investment conclusions.
Do not approve hidden, unpinned, or unexplained installation and update commands.
Do not replace a required workflow with general reasoning when specialized analysis is necessary.