The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads financial reports and meeting materials from Wind's official servers (alice.wind.com.cn, mcp.wind.com.cn). These are vendor-owned resources used for the skill's primary function and do not pose a security risk.
[COMMAND_EXECUTION]: The skill uses node and spawn to execute its internal request.js script and a daily update check script (update-check.mjs). These are standard operational patterns for a Node.js CLI tool.
[REMOTE_CODE_EXECUTION]: The update-check.mjs script facilitates skill updates by calling npx skills update or npx skills add. These operations target the official Wind repository on GitHub or Gitee, which are trusted sources for this specific vendor.
[DATA_EXPOSURE]: The skill reads the WIND_API_KEY from local configuration files (~/.wind-aifinmarket/config or config.json). It contains explicit instructions and code logic to prevent these credentials from being printed in the output or leaked to the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user input via the --prompt argument and sends it to an external AI service. While this is an ingestion point, the skill operates as a pass-through CLI, and the actual processing is handled by the vendor's backend, which typically has its own safety guardrails.

wind-alice-meeting-expert