The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a background update script (update-check.mjs) that executes shell commands to manage its lifecycle.
The script uses child_process.spawnSync to run git, npx, and node for update verification and installation.
These commands are directed towards official vendor repositories and standard developer tools.
[REMOTE_CODE_EXECUTION]: The automated update process uses npx skills to download and install newer versions of the skill.
Update sources include official GitHub (Wind-Information-Co-Ltd/wind-skills) and Gitee (wind_info/wind-skills) repositories.
This mechanism is a standard feature for maintaining the skill's compatibility with the Wind Alice platform.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of financial research reports and data attachments.
Attachments are fetched from the alice.wind.com.cn domain, which serves as the official artifact storage for the Wind service.
All downloads are performed using the user's provided Wind API credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes responses from the Wind Alice API, which may contain external research data.
Data is ingested through the platform's SSE (Server-Sent Events) endpoint in scripts/request.js.
The skill has capabilities to write files to the local .agents/download/ directory and run background maintenance tasks.
Given the specialized financial nature of the ingested data and the provided usage constraints, the exploitation surface is considered typical for this category of tool.

wind-alice-equity-research-expert