Skills wind-mcp-skill

📦

wind-mcp-skill

Name: wind-mcp-skill
Author: Wind

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Access Wind Financial Data

Financial agents need reliable market, fund, bond, document, news, and macroeconomic data. This skill routes requests to Wind MCP tools and returns sourced results.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "wind-mcp-skill" from https://skillstore.io/skills/wind-information-co-ltd-wind-mcp-skill.md and its manifest at https://skillstore.io/api/skills/wind-information-co-ltd-wind-mcp-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/wind-information-co-ltd-wind-mcp-skill.md Signed manifest GET /api/skills/wind-information-co-ltd-wind-mcp-skill/manifest Signed lockfile GET /api/skills/wind-information-co-ltd-wind-mcp-skill/lockfile

Test it

Using "wind-mcp-skill". 贵州茅台今天最新价

Expected outcome:

The response reports the latest Wind price fields, states missing fields if any, and ends with Wind as the data source.

Using "wind-mcp-skill". 筛选近一年收益率超20%的股票型基金

Expected outcome:

A ranked list of matching funds with codes, names, return period, size, manager, and data coverage notes.

Using "wind-mcp-skill". 中国近10年新能源汽车产销量

Expected outcome:

A macro indicator summary with available series, date range, units, and notes on coverage limits.

Security Audit

High Risk

v2 • 7/6/2026 Open versioned report

Most static detections are false positives from documentation, template literals, regexes, and readable Chinese reference text. Confirmed risks are credential handling, authenticated Wind network calls, and a background updater that can execute package-manager commands. No prompt injection attempts were found in the reviewed files.

Files scanned

2,806

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

scripts/cli.mjs:508

Environment file access

const envKey = process.env.WIND_API_KEY?.trim();

The line reads WIND_API_KEY from the process environment. It is not an environment file read, but it is sensitive secret access.

High

scripts/update-check.mjs:85

Environment file access

const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

High

scripts/update-check.mjs:101

Environment file access

const xdg = process.env.XDG_STATE_HOME;

This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.

High

scripts/update-check.mjs:175

Environment file access

...process.env

The updater forwards the full process environment to child commands. This can expose sensitive environment values to git or npx execution.

High

README.md:75-78 scripts/cli.mjs:124-135 scripts/update-check.mjs:397-402 scripts/update-check.mjs:428-464

Automatic Background Update Executes Package Manager

The CLI starts a detached updater after successful data calls. The updater can run npx skills update or add commands and change installed skill files without per-run user confirmation.

The README documents daily automatic updates, and the code spawns update-check before running npx update or add commands. This is a behavior-level supply-chain risk.

Capability review items (37)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/cli.mjs:7

Node.js child_process module

import { spawn } from 'node:child_process';

The CLI imports child_process and uses spawn for local updater and browser commands. No direct user-controlled shell was found, but command execution is real.

High

scripts/cli.mjs:133

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

The CLI spawns a detached Node updater from a copied script after successful calls. This can execute update logic without per-run user confirmation.

High

scripts/cli.mjs:494

Generic API/secret keys

const key = env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/cli.mjs:503

Generic API/secret keys

const key = typeof cfg.wind_api_key === 'string' ? cfg.wind_api_key.trim() : '';

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/cli.mjs:508

Generic API/secret keys

const envKey = process.env.WIND_API_KEY?.trim();

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/cli.mjs:808

Generic API/secret keys

.filter(l => l.length > 0 && !/^\s*(export\s+)?WIND_API_KEY\s*=/.test(l));

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/cli.mjs:810

Generic API/secret keys

lines.push(`WIND_API_KEY=${key}`);

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/cli.mjs:816

Generic API/secret keys

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.

High

scripts/update-check.mjs:21

Node.js child_process module

} from 'node:child_process';

The updater imports child_process for synchronous git and npx execution. That command execution can alter installed skill files.

High

scripts/update-check.mjs:184

Synchronous spawn

const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {

The updater runs git ls-remote against a source URL from lock metadata. Arguments are array-based, but this is real external command and network execution.

High

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

The updater runs npx skills update or add in the background. This package-manager path can modify executable skill content.

High

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows the updater executes a joined command string through cmd.exe. Lock-derived command parts increase shell parsing risk.

High

SKILL.md:9

Node.js child_process module

child_process: true

The skill explicitly declares child_process support, matching executable Node scripts in the package. This is a real permission risk, although not an exploit by itself.

Medium

scripts/cli.mjs:635

Fetch API call

resp = await fetch(server.endpoint, {

The CLI posts JSON-RPC requests to Wind MCP endpoints with an Authorization bearer token. This is expected, but it sends authenticated data externally.

Medium

scripts/cli.mjs:493

Synchronous file operations

const env = parseDotenv(readFileSync(globalConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

Medium

scripts/cli.mjs:502

Synchronous file operations

const cfg = JSON.parse(readFileSync(localConfig, 'utf8'));

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

Medium

scripts/cli.mjs:807

Synchronous file operations

lines = readFileSync(file, 'utf8').split('\n')

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

Medium

scripts/cli.mjs:811

Synchronous file operations

writeFileSync(file, lines.join('\n') + '\n', {

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

Medium

scripts/cli.mjs:816

Synchronous file operations

writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });

This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.

Medium

scripts/cli.mjs:508

Environment variable access (dot notation)

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

Medium

scripts/cli.mjs:508

Environment variable object

const envKey = process.env.WIND_API_KEY?.trim();

The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.

Medium

scripts/cli.mjs:178

dotenv library

// dotenv 解析: 兼容注释 / 引号 / export 前缀

The custom dotenv parser is used to load WIND_API_KEY from local configuration. This is expected, but it handles sensitive credential material.

Medium

scripts/update-check.mjs:126

Synchronous file operations

const data = JSON.parse(readFileSync(file, 'utf8'));

The updater reads lock metadata that can influence update source selection. This is expected, but it contributes to supply-chain risk.

Medium

scripts/update-check.mjs:175

Environment variable object

...process.env

The updater passes the full process environment to git and npx child processes. Any secrets in the environment are forwarded to those commands.

Low

scripts/cli.mjs:14

Hardcoded URL

endpoint: 'https://mcp.wind.com.cn/vserver_stock_data/mcp/',