Versioned security assessment
Report ID: SA-E82D22AC
7/6/2026, 12:56:07 PM
wind-mcp-skill security assessment v2
Skill Security Certification Report
Audit model: codex Latest published report
- Skill name
- wind-mcp-skill
- Version
- v2
- Maintainer
- Wind
- Coverage
- 11 Files scanned · 2,806 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
5 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static detections are false positives from documentation, template literals, regexes, and readable Chinese reference text. Confirmed risks are credential handling, authenticated Wind network calls, and a background updater that can execute package-manager commands. No prompt injection attempts were found in the reviewed files.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
11 Files scanned · 2,806 Lines analyzed
42 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 14 evidence locations
Filesystem access
May read or write local files.
Observed in 30 evidence locations
Env variables
May read values from the process environment.
Observed in 14 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 149 evidence locations
Capability review items (37)
High
Node.js child_process module
import { spawn } from 'node:child_process';
The CLI imports child_process and uses spawn for local updater and browser commands. No direct user-controlled shell was found, but command execution is real.
High
Process spawn
const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:
The CLI spawns a detached Node updater from a copied script after successful calls. This can execute update logic without per-run user confirmation.
High
Generic API/secret keys
const key = env.WIND_API_KEY?.trim();
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Generic API/secret keys
const key = typeof cfg.wind_api_key === 'string' ? cfg.wind_api_key.trim() : '';
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Generic API/secret keys
const envKey = process.env.WIND_API_KEY?.trim();
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Generic API/secret keys
.filter(l => l.length > 0 && !/^\s*(export\s+)?WIND_API_KEY\s*=/.test(l));
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Generic API/secret keys
lines.push(`WIND_API_KEY=${key}`);
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Generic API/secret keys
writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
High
Node.js child_process module
} from 'node:child_process';
The updater imports child_process for synchronous git and npx execution. That command execution can alter installed skill files.
High
Synchronous spawn
const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {
The updater runs git ls-remote against a source URL from lock metadata. Arguments are array-based, but this is real external command and network execution.
High
Synchronous spawn
const result = spawnSync(bin, args, {
The updater runs npx skills update or add in the background. This package-manager path can modify executable skill content.
High
Windows cmd.exe
const bin = isWin ? 'cmd.exe' : 'npx';
On Windows the updater executes a joined command string through cmd.exe. Lock-derived command parts increase shell parsing risk.
High
Node.js child_process module
child_process: true
The skill explicitly declares child_process support, matching executable Node scripts in the package. This is a real permission risk, although not an exploit by itself.
Medium
Fetch API call
resp = await fetch(server.endpoint, {
The CLI posts JSON-RPC requests to Wind MCP endpoints with an Authorization bearer token. This is expected, but it sends authenticated data externally.
Medium
Synchronous file operations
const env = parseDotenv(readFileSync(globalConfig, 'utf8'));
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
Medium
Synchronous file operations
const cfg = JSON.parse(readFileSync(localConfig, 'utf8'));
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
Medium
Synchronous file operations
lines = readFileSync(file, 'utf8').split('\n')
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
Medium
Synchronous file operations
writeFileSync(file, lines.join('\n') + '\n', {
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
Medium
Synchronous file operations
writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
Medium
Environment variable access (dot notation)
const envKey = process.env.WIND_API_KEY?.trim();
The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.
Medium
Environment variable object
const envKey = process.env.WIND_API_KEY?.trim();
The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.
Medium
dotenv library
// dotenv 解析: 兼容注释 / 引号 / export 前缀
The custom dotenv parser is used to load WIND_API_KEY from local configuration. This is expected, but it handles sensitive credential material.
Medium
Synchronous file operations
const data = JSON.parse(readFileSync(file, 'utf8'));
The updater reads lock metadata that can influence update source selection. This is expected, but it contributes to supply-chain risk.
Medium
Environment variable object
...process.env
The updater passes the full process environment to git and npx child processes. Any secrets in the environment are forwarded to those commands.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_stock_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_fund_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_index_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_bond_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_financial_docs/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_economic_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_analytics_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
Low
Hardcoded URL
return `https://github.com/${entry.source}.git`;
The updater constructs a GitHub source URL for update checks. This is expected, but it is part of external update behavior.
Low
Hardcoded URL
return `https://gitee.com/${entry.source}.git`;
The updater constructs a Gitee source URL for update checks. This is expected, but it is part of external update behavior.
Low
Environment variable access (dot notation)
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
Low
Environment variable access (dot notation)
const xdg = process.env.XDG_STATE_HOME;
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
Low
Environment variable object
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
Low
Environment variable object
const xdg = process.env.XDG_STATE_HOME;
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (5)
RISK-001 High
Environment file access
const envKey = process.env.WIND_API_KEY?.trim();
The line reads WIND_API_KEY from the process environment. It is not an environment file read, but it is sensitive secret access.
RISK-002 High
Environment file access
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.
RISK-003 High
Environment file access
const xdg = process.env.XDG_STATE_HOME;
This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.
RISK-004 High
Environment file access
...process.env
The updater forwards the full process environment to child commands. This can expose sensitive environment values to git or npx execution.
RISK-005 High
README.md:75-78scripts/cli.mjs:124-135scripts/update-check.mjs:397-402scripts/update-check.mjs:428-464
Automatic Background Update Executes Package Manager
The CLI starts a detached updater after successful data calls. The updater can run npx skills update or add commands and change installed skill files without per-run user confirmation.
The README documents daily automatic updates, and the code spawns update-check before running npx update or add commands. This is a behavior-level supply-chain risk.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighBackground auto-update command executionDisable automatic updates by default, require explicit user consent, pin trusted sources, and avoid detached npx execution.
- FIX-002HighWindows updater shell invocationAvoid cmd.exe with joined command strings. Spawn a fixed executable with validated arguments instead.
- FIX-003MediumAPI key storage and processingPrefer OS credential storage or environment variables, document file permissions, and avoid skill-local secrets when possible.
- FIX-004MediumAuthenticated external network callsDocument every Wind endpoint, reject unexpected hosts, and avoid sending unnecessary user query data.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- e82d22ace449afa2495e5c931b687eb19f360093
- Content hash
- 6436daa92308083f6f3319f3900dd2d645942684e3765fdeba2c97c45bf26cce
- Tree hash
- cc08e76764b88c1e7c64b48532c4f6841b110d62b3b283d252581b49291ad002
- Skill path
- skills/wind-information-co-ltd/wind-mcp-skill
- Audit payload hash
- 8ee1e62d96c0e68ee7ece697b4784a23
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable