此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-E82D22AC
7/6/2026, 12:56:07 PM
wind-mcp-skill 安全评估 v2
Skill 安全认证报告
审计模型: codex 最新发布的报告
- 技能名称
- wind-mcp-skill
- 版本
- v2
- 维护者
- Wind
- 覆盖范围
- 11 已扫描文件 · 2,806 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
高
有 5 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most static detections are false positives from documentation, template literals, regexes, and readable Chinese reference text. Confirmed risks are credential handling, authenticated Wind network calls, and a background updater that can execute package-manager commands. No prompt injection attempts were found in the reviewed files.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
11 已扫描文件 · 2,806 分析行数
有 42 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 14 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 30 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 14 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 149 个证据位置观察到
能力复核项 (37)
高
Node.js child_process module
import { spawn } from 'node:child_process';
The CLI imports child_process and uses spawn for local updater and browser commands. No direct user-controlled shell was found, but command execution is real.
高
Process spawn
const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:
The CLI spawns a detached Node updater from a copied script after successful calls. This can execute update logic without per-run user confirmation.
高
Generic API/secret keys
const key = env.WIND_API_KEY?.trim();
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Generic API/secret keys
const key = typeof cfg.wind_api_key === 'string' ? cfg.wind_api_key.trim() : '';
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Generic API/secret keys
const envKey = process.env.WIND_API_KEY?.trim();
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Generic API/secret keys
.filter(l => l.length > 0 && !/^\s*(export\s+)?WIND_API_KEY\s*=/.test(l));
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Generic API/secret keys
lines.push(`WIND_API_KEY=${key}`);
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Generic API/secret keys
writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });
The line reads, filters, or writes WIND_API_KEY material. This credential handling is expected but security-sensitive.
高
Node.js child_process module
} from 'node:child_process';
The updater imports child_process for synchronous git and npx execution. That command execution can alter installed skill files.
高
Synchronous spawn
const result = spawnSync('git', ['ls-remote', source, 'HEAD'], {
The updater runs git ls-remote against a source URL from lock metadata. Arguments are array-based, but this is real external command and network execution.
高
Synchronous spawn
const result = spawnSync(bin, args, {
The updater runs npx skills update or add in the background. This package-manager path can modify executable skill content.
高
Windows cmd.exe
const bin = isWin ? 'cmd.exe' : 'npx';
On Windows the updater executes a joined command string through cmd.exe. Lock-derived command parts increase shell parsing risk.
高
Node.js child_process module
child_process: true
The skill explicitly declares child_process support, matching executable Node scripts in the package. This is a real permission risk, although not an exploit by itself.
中
Fetch API call
resp = await fetch(server.endpoint, {
The CLI posts JSON-RPC requests to Wind MCP endpoints with an Authorization bearer token. This is expected, but it sends authenticated data externally.
中
Synchronous file operations
const env = parseDotenv(readFileSync(globalConfig, 'utf8'));
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
中
Synchronous file operations
const cfg = JSON.parse(readFileSync(localConfig, 'utf8'));
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
中
Synchronous file operations
lines = readFileSync(file, 'utf8').split('\n')
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
中
Synchronous file operations
writeFileSync(file, lines.join('\n') + '\n', {
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
中
Synchronous file operations
writeFileSync(file, JSON.stringify({ wind_api_key: key }, null, 2) + '\n', { mode: 0o600 });
This file operation reads or writes API key configuration. Permissions are restricted on writes, but credential file access is security-sensitive.
中
Environment variable access (dot notation)
const envKey = process.env.WIND_API_KEY?.trim();
The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.
中
Environment variable object
const envKey = process.env.WIND_API_KEY?.trim();
The CLI reads process.env.WIND_API_KEY. That secret is later used as the bearer token for Wind network requests.
中
dotenv library
// dotenv 解析: 兼容注释 / 引号 / export 前缀
The custom dotenv parser is used to load WIND_API_KEY from local configuration. This is expected, but it handles sensitive credential material.
中
Synchronous file operations
const data = JSON.parse(readFileSync(file, 'utf8'));
The updater reads lock metadata that can influence update source selection. This is expected, but it contributes to supply-chain risk.
中
Environment variable object
...process.env
The updater passes the full process environment to git and npx child processes. Any secrets in the environment are forwarded to those commands.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_stock_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_fund_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_index_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_bond_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_financial_docs/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_economic_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
endpoint: 'https://mcp.wind.com.cn/vserver_analytics_data/mcp/',
This hardcoded Wind MCP endpoint is used by the CLI network request path. It is expected functionality, but it confirms external network dependency.
低
Hardcoded URL
return `https://github.com/${entry.source}.git`;
The updater constructs a GitHub source URL for update checks. This is expected, but it is part of external update behavior.
低
Hardcoded URL
return `https://gitee.com/${entry.source}.git`;
The updater constructs a Gitee source URL for update checks. This is expected, but it is part of external update behavior.
低
Environment variable access (dot notation)
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
低
Environment variable access (dot notation)
const xdg = process.env.XDG_STATE_HOME;
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
低
Environment variable object
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
低
Environment variable object
const xdg = process.env.XDG_STATE_HOME;
The updater trusts environment-controlled paths while searching lock files. This is not secret access, but it can affect update metadata selection.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (5)
RISK-001 高
Environment file access
const envKey = process.env.WIND_API_KEY?.trim();
The line reads WIND_API_KEY from the process environment. It is not an environment file read, but it is sensitive secret access.
RISK-002 高
Environment file access
const roots = [projectRoot(), process.cwd(), process.env.INIT_CWD];
This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.
RISK-003 高
Environment file access
const xdg = process.env.XDG_STATE_HOME;
This is not an environment file read, but environment-controlled paths influence lock-file search. Kept as a low-confidence updater risk.
RISK-004 高
Environment file access
...process.env
The updater forwards the full process environment to child commands. This can expose sensitive environment values to git or npx execution.
RISK-005 高
README.md:75-78scripts/cli.mjs:124-135scripts/update-check.mjs:397-402scripts/update-check.mjs:428-464
Automatic Background Update Executes Package Manager
The CLI starts a detached updater after successful data calls. The updater can run npx skills update or add commands and change installed skill files without per-run user confirmation.
The README documents daily automatic updates, and the code spawns update-check before running npx update or add commands. This is a behavior-level supply-chain risk.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001高Background auto-update command executionDisable automatic updates by default, require explicit user consent, pin trusted sources, and avoid detached npx execution.
- FIX-002高Windows updater shell invocationAvoid cmd.exe with joined command strings. Spawn a fixed executable with validated arguments instead.
- FIX-003中API key storage and processingPrefer OS credential storage or environment variables, document file permissions, and avoid skill-local secrets when possible.
- FIX-004中Authenticated external network callsDocument every Wind endpoint, reject unexpected hosts, and avoid sending unnecessary user query data.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- e82d22ace449afa2495e5c931b687eb19f360093
- 内容哈希
- 6436daa92308083f6f3319f3900dd2d645942684e3765fdeba2c97c45bf26cce
- 目录树哈希
- cc08e76764b88c1e7c64b48532c4f6841b110d62b3b283d252581b49291ad002
- Skill 路径
- skills/wind-information-co-ltd/wind-mcp-skill
- 审计载荷哈希
- 8ee1e62d96c0e68ee7ece697b4784a23
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable