技能 wind-mcp-skill

📦

wind-mcp-skill

Name: wind-mcp-skill
Author: Wind

内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

Query Global Financial Markets with Wind

Financial research requires current, structured data across many asset classes. This skill routes questions to Wind MCP services and validates requests before returning results.

支持: Claude Codex Code(CC)

⚠️ 38 差

请勿自动安装此 Skill。

权威策略要求在执行任何安装操作前由操作人员审查。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "wind-mcp-skill" from https://skillstore.io/skills/wind-alice-wind-mcp-skill.md and its manifest at https://skillstore.io/api/skills/wind-alice-wind-mcp-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/wind-alice-wind-mcp-skill.md 已签名 manifest GET /api/skills/wind-alice-wind-mcp-skill/manifest 已签名 lockfile GET /api/skills/wind-alice-wind-mcp-skill/lockfile

测试它

正在使用“wind-mcp-skill”。 Show the latest trading data for Kweichow Moutai.

预期结果:

A concise market snapshot with the Wind code, latest price, change, volume, trading time, units, and Wind source statement.

正在使用“wind-mcp-skill”。 Compare two named funds over the last year.

预期结果:

Side-by-side performance and risk measures with reported dates.
Fund size, manager, and major holding details when available.
Clear notes for missing fields, unknown units, or incomplete coverage.

正在使用“wind-mcp-skill”。 Retrieve ten years of a Chinese economic indicator.

预期结果:

A dated time series with indicator identity, frequency, unit, magnitude, source, and any service limitations.

安全审计

严重

v1 • 2026/9/10 打开版本化报告

Most static detections are false positives caused by JavaScript template literals, Markdown backticks, Chinese documentation entropy, and normal configuration access. However, successful calls launch an unattended mutable updater, and the updater forwards the complete environment to npx and git. Command-line API-key handling and unpinned global fallback installation add credential and supply-chain exposure.

已扫描文件

2,471

分析行数

复核项

已忽略误报

已确认安全问题 (3)

严重

scripts/cli.mjs:137-148 scripts/cli.mjs:1032-1037 scripts/update-check.mjs:78-81 scripts/update-check.mjs:397-409 scripts/update-check.mjs:428-464

Unattended Mutable Self-Update

Every successful data call can launch a detached updater that runs unpinned npx update or add commands without update-specific confirmation. Remote compromise could replace executable skill code.

The call success path directly schedules the detached updater, which executes npx with approval bypass flags and mutable sources.

高

scripts/cli.mjs:859-865

API Key Exposed Through Command Arguments

The setup-key command receives the API key through process arguments. Shell history and process inspection can retain the secret before it is stored.

The code assigns rawArgs[0] directly to the key, and the documented command syntax requires the secret as a positional argument.

高

SKILL.md:111

Unpinned Global Fallback Installation

The workflow tells the agent to install wind-alice globally from an unpinned repository with automatic approval. User consent is required, but source integrity is not verified.

The exact npx commands use mutable repository references, global scope, and the noninteractive approval flag without a commit or checksum.

能力复核项 (4)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

严重

scripts/cli.mjs:146

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

This spawn launches a detached updater after successful data calls. The background process can replace skill code without an update-specific user confirmation.

严重

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

This executes unattended npx update or add commands assembled by the updater. The command can install mutable remote code with the current user privileges.

严重

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows, the unattended update is routed through cmd.exe with a joined command string. Mutable source and skill values are not shell-escaped, adding command-injection exposure.

高

scripts/update-check.mjs:175

Environment variable object

...process.env

The updater copies the complete process environment into git and npx subprocesses. A compromised update tool or dependency could read unrelated host secrets.

风险因素

⚙️ 外部命令 (50)

scripts/cli.mjs:7 scripts/cli.mjs:146 scripts/cli.mjs:944 scripts/cli.mjs:56 scripts/cli.mjs:57 scripts/cli.mjs:58 scripts/cli.mjs:59 scripts/cli.mjs:60 scripts/cli.mjs:61 scripts/cli.mjs:62 scripts/cli.mjs:63 scripts/cli.mjs:64 scripts/cli.mjs:65 scripts/cli.mjs:66 scripts/cli.mjs:67 scripts/cli.mjs:144 scripts/cli.mjs:160 scripts/cli.mjs:167 scripts/cli.mjs:175 scripts/cli.mjs:278 scripts/cli.mjs:340 scripts/cli.mjs:354 scripts/cli.mjs:357 scripts/cli.mjs:362 scripts/cli.mjs:367 scripts/cli.mjs:376 scripts/cli.mjs:386 scripts/cli.mjs:456 scripts/cli.mjs:486 scripts/cli.mjs:488 scripts/cli.mjs:530 scripts/cli.mjs:535 scripts/cli.mjs:550 scripts/cli.mjs:557 scripts/cli.mjs:563 scripts/cli.mjs:571 scripts/cli.mjs:578 scripts/cli.mjs:583 scripts/cli.mjs:608 scripts/cli.mjs:611 scripts/cli.mjs:644 scripts/cli.mjs:677 scripts/cli.mjs:696 scripts/cli.mjs:781 scripts/cli.mjs:792 scripts/cli.mjs:793 scripts/cli.mjs:794 scripts/cli.mjs:811 scripts/cli.mjs:812 scripts/cli.mjs:813

🌐 网络访问 (12)

scripts/cli.mjs:15 scripts/cli.mjs:19 scripts/cli.mjs:23 scripts/cli.mjs:27 scripts/cli.mjs:31 scripts/cli.mjs:35 scripts/cli.mjs:39 scripts/cli.mjs:44 scripts/update-check.mjs:160 scripts/update-check.mjs:167 SKILL.md:6 SKILL.md:111

📁 文件系统访问 (30)

🔑 环境变量 (18)

scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:288 scripts/cli.mjs:282 scripts/cli.mjs:315 scripts/cli.mjs:324 scripts/cli.mjs:329 scripts/cli.mjs:332 scripts/cli.mjs:906 scripts/cli.mjs:908 scripts/cli.mjs:914 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg)](https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/wind-alice-wind-mcp-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

Wind. (2026). wind-mcp-skill security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1

BibTeX 引用

@techreport{wind-wind-alice-wind-mcp-skill-2026,
  author = {Wind},
  title = {wind-mcp-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wind-mcp-skill security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "Wind"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:wind-alice-wind-mcp-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

比较变体

2 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

证据置信度更高

作者 / 来源 Skillstore 评分证据置信度 Skillstore 使用量已更新

Wind 推荐

wind-information-co-ltd-wind-mcp-skill

Skillstore 评分 38

证据置信度中

Skillstore 使用量 30

已更新

2026-09-09

Wind 当前

wind-alice-wind-mcp-skill

Skillstore 评分 38

证据置信度低

Skillstore 使用量 5

已更新

2026-10-06

Skillstore 评分

评分依据证据置信度: 低

架构

可维护性

内容

社区

规范符合性

你能构建什么

Screen Investment Candidates

Filter stocks or funds by market, size, performance, valuation, and other supported criteria.

Build Market Research

Collect quotes, fundamentals, disclosures, news, and economic series for evidence-based reports.

Validate Portfolio Data

Compare holdings, performance, risk metrics, and index indicators using structured Wind responses.

试试这些提示

Get a Current Quote

Get the latest price, change, volume, and trading time for [security name or Wind code].

Screen a Market

Screen [market] stocks for [criteria]. Return matching names, Wind codes, requested metrics, and data dates.

Compare Funds

Compare [fund list] by one-year performance, volatility, drawdown, size, manager, and major holdings. Preserve returned units and dates.

Combine Market and Economic Evidence

Analyze [topic] using relevant securities, disclosures, news, and economic indicators from [date range]. Separate returned facts from calculations and state limitations.

最佳实践

Use exact security names or Wind codes and specify the desired date range.
Request only necessary fields and preserve units, magnitude, and timestamps from Wind metadata.
Start batch work with one probe request and stop on authentication, quota, or backend errors.

避免

Do not infer missing values, exchange suffixes, units, or financial conclusions.
Do not use broad analytics tools when a dedicated asset-domain tool supports the request.
Do not place API keys in shared prompts, logs, repositories, or command histories.