The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node:child_process to manage its internal execution flow and background updates. The main entry point wind-alice-wealth-advisor.mjs spawns request.js to handle network operations, and update-check.mjs spawns npx commands for version management.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to automatically fetch financial reports and artifacts from https://alice.wind.com.cn/weaver/files/. These downloads are authenticated using the user's provided WIND_API_KEY and are saved to a local .agents/download/ directory for user access.
[REMOTE_CODE_EXECUTION]: The update-check.mjs script implements an automated update mechanism that executes npx skills update and npx skills add to keep the skill synchronized with the official vendor repository at github.com/Wind-Information-Co-Ltd/wind-skills. This behavior is scoped to the vendor's own maintenance tools.
[INDIRECT_PROMPT_INJECTION]: The skill is a high-capability agent wrapper that processes untrusted user input and external agent responses.
Ingestion points: The --prompt CLI argument in scripts/request.js accepts raw user input.
Boundary markers: Absent; instructions require passing raw, unedited text to the backend.
Capability inventory: Includes network requests (fetch) and file system writes (node:fs / pipeline) for downloading reports.
Sanitization: The agentResultSanitize.js script reformats external links into local Markdown links but does not filter the natural language content of the agent's response.
[SAFE_PRACTICE]: The skill follows security best practices for credential management by reading the WIND_API_KEY from environment variables or local configuration files (~/.wind-aifinmarket/config) rather than requiring hardcoded secrets or prompt-based injection of keys.

wind-alice-wealth-advisor