技能 wind-mcp-skill

📦

wind-mcp-skill

Name: wind-mcp-skill
Author: Wind

內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Query Global Financial Markets with Wind

Financial research requires current, structured data across many asset classes. This skill routes questions to Wind MCP services and validates requests before returning results.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "wind-mcp-skill" from https://skillstore.io/skills/wind-alice-wind-mcp-skill.md and its manifest at https://skillstore.io/api/skills/wind-alice-wind-mcp-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/wind-alice-wind-mcp-skill.md 已簽名 manifest GET /api/skills/wind-alice-wind-mcp-skill/manifest 已簽名 lockfile GET /api/skills/wind-alice-wind-mcp-skill/lockfile

測試它

正在使用「wind-mcp-skill」。 Show the latest trading data for Kweichow Moutai.

預期結果:

A concise market snapshot with the Wind code, latest price, change, volume, trading time, units, and Wind source statement.

正在使用「wind-mcp-skill」。 Compare two named funds over the last year.

預期結果:

Side-by-side performance and risk measures with reported dates.
Fund size, manager, and major holding details when available.
Clear notes for missing fields, unknown units, or incomplete coverage.

正在使用「wind-mcp-skill」。 Retrieve ten years of a Chinese economic indicator.

預期結果:

A dated time series with indicator identity, frequency, unit, magnitude, source, and any service limitations.

安全審計

嚴重

v1 • 2026/9/10 開啟版本化報告

Most static detections are false positives caused by JavaScript template literals, Markdown backticks, Chinese documentation entropy, and normal configuration access. However, successful calls launch an unattended mutable updater, and the updater forwards the complete environment to npx and git. Command-line API-key handling and unpinned global fallback installation add credential and supply-chain exposure.

已掃描檔案

2,471

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (3)

嚴重

scripts/cli.mjs:137-148 scripts/cli.mjs:1032-1037 scripts/update-check.mjs:78-81 scripts/update-check.mjs:397-409 scripts/update-check.mjs:428-464

Unattended Mutable Self-Update

Every successful data call can launch a detached updater that runs unpinned npx update or add commands without update-specific confirmation. Remote compromise could replace executable skill code.

The call success path directly schedules the detached updater, which executes npx with approval bypass flags and mutable sources.

高

scripts/cli.mjs:859-865

API Key Exposed Through Command Arguments

The setup-key command receives the API key through process arguments. Shell history and process inspection can retain the secret before it is stored.

The code assigns rawArgs[0] directly to the key, and the documented command syntax requires the secret as a positional argument.

高

SKILL.md:111

Unpinned Global Fallback Installation

The workflow tells the agent to install wind-alice globally from an unpinned repository with automatic approval. User consent is required, but source integrity is not verified.

The exact npx commands use mutable repository references, global scope, and the noninteractive approval flag without a commit or checksum.

能力複核項目 (4)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

嚴重

scripts/cli.mjs:146

Process spawn

const child = spawn('node', [runnerPath, SKILL_DIR], { detached: true, stdio: 'ignore', windowsHide:

This spawn launches a detached updater after successful data calls. The background process can replace skill code without an update-specific user confirmation.

嚴重

scripts/update-check.mjs:402

Synchronous spawn

const result = spawnSync(bin, args, {

This executes unattended npx update or add commands assembled by the updater. The command can install mutable remote code with the current user privileges.

嚴重

scripts/update-check.mjs:400

Windows cmd.exe

const bin = isWin ? 'cmd.exe' : 'npx';

On Windows, the unattended update is routed through cmd.exe with a joined command string. Mutable source and skill values are not shell-escaped, adding command-injection exposure.

高

scripts/update-check.mjs:175

Environment variable object

...process.env

The updater copies the complete process environment into git and npx subprocesses. A compromised update tool or dependency could read unrelated host secrets.

風險因素

⚙️ 外部命令 (50)

scripts/cli.mjs:7 scripts/cli.mjs:146 scripts/cli.mjs:944 scripts/cli.mjs:56 scripts/cli.mjs:57 scripts/cli.mjs:58 scripts/cli.mjs:59 scripts/cli.mjs:60 scripts/cli.mjs:61 scripts/cli.mjs:62 scripts/cli.mjs:63 scripts/cli.mjs:64 scripts/cli.mjs:65 scripts/cli.mjs:66 scripts/cli.mjs:67 scripts/cli.mjs:144 scripts/cli.mjs:160 scripts/cli.mjs:167 scripts/cli.mjs:175 scripts/cli.mjs:278 scripts/cli.mjs:340 scripts/cli.mjs:354 scripts/cli.mjs:357 scripts/cli.mjs:362 scripts/cli.mjs:367 scripts/cli.mjs:376 scripts/cli.mjs:386 scripts/cli.mjs:456 scripts/cli.mjs:486 scripts/cli.mjs:488 scripts/cli.mjs:530 scripts/cli.mjs:535 scripts/cli.mjs:550 scripts/cli.mjs:557 scripts/cli.mjs:563 scripts/cli.mjs:571 scripts/cli.mjs:578 scripts/cli.mjs:583 scripts/cli.mjs:608 scripts/cli.mjs:611 scripts/cli.mjs:644 scripts/cli.mjs:677 scripts/cli.mjs:696 scripts/cli.mjs:781 scripts/cli.mjs:792 scripts/cli.mjs:793 scripts/cli.mjs:794 scripts/cli.mjs:811 scripts/cli.mjs:812 scripts/cli.mjs:813

🌐 網路存取 (12)

scripts/cli.mjs:15 scripts/cli.mjs:19 scripts/cli.mjs:23 scripts/cli.mjs:27 scripts/cli.mjs:31 scripts/cli.mjs:35 scripts/cli.mjs:39 scripts/cli.mjs:44 scripts/update-check.mjs:160 scripts/update-check.mjs:167 SKILL.md:6 SKILL.md:111

📁 檔案系統存取 (30)

🔑 環境變數 (18)

scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:329 scripts/cli.mjs:674 scripts/cli.mjs:288 scripts/cli.mjs:282 scripts/cli.mjs:315 scripts/cli.mjs:324 scripts/cli.mjs:329 scripts/cli.mjs:332 scripts/cli.mjs:906 scripts/cli.mjs:908 scripts/cli.mjs:914 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:85 scripts/update-check.mjs:101 scripts/update-check.mjs:175

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg)](https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/wind-alice-wind-mcp-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wind-alice-wind-mcp-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/wind-alice-wind-mcp-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

Wind. (2026). wind-mcp-skill security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1

BibTeX 引用

@techreport{wind-wind-alice-wind-mcp-skill-2026,
  author = {Wind},
  title = {wind-mcp-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wind-mcp-skill security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "Wind"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/wind-alice-wind-mcp-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:wind-alice-wind-mcp-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

證據信心較高

作者 / 來源 Skillstore 評分證據置信度 Skillstore 使用量已更新

Wind 推薦

wind-information-co-ltd-wind-mcp-skill

Skillstore 評分 38

證據置信度中

Skillstore 使用量 33

已更新

2026-09-09

Wind 目前

wind-alice-wind-mcp-skill

Skillstore 評分 38

證據置信度低

Skillstore 使用量 8

已更新

2026-10-06

Skillstore 評分

評分依據證據置信度: 低

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Screen Investment Candidates

Filter stocks or funds by market, size, performance, valuation, and other supported criteria.

Build Market Research

Collect quotes, fundamentals, disclosures, news, and economic series for evidence-based reports.

Validate Portfolio Data

Compare holdings, performance, risk metrics, and index indicators using structured Wind responses.

試試這些提示

Get a Current Quote

Get the latest price, change, volume, and trading time for [security name or Wind code].

Screen a Market

Screen [market] stocks for [criteria]. Return matching names, Wind codes, requested metrics, and data dates.

Compare Funds

Compare [fund list] by one-year performance, volatility, drawdown, size, manager, and major holdings. Preserve returned units and dates.

Combine Market and Economic Evidence

Analyze [topic] using relevant securities, disclosures, news, and economic indicators from [date range]. Separate returned facts from calculations and state limitations.

最佳實務

Use exact security names or Wind codes and specify the desired date range.
Request only necessary fields and preserve units, magnitude, and timestamps from Wind metadata.
Start batch work with one probe request and stop on authentication, quota, or backend errors.

避免

Do not infer missing values, exchange suffixes, units, or financial conclusions.
Do not use broad analytics tools when a dedicated asset-domain tool supports the request.
Do not place API keys in shared prompts, logs, repositories, or command histories.