wind-alice

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes an automated background update process in update-check.mjs. It periodically synchronizes with official repositories for Wind Information Co. Ltd. on platforms like GitHub and Gitee using the npx skills tool.
  • [COMMAND_EXECUTION]: The utility uses child_process.spawn to manage its internal request logic and update routine. These commands are hardcoded and restricted to the tool's intended operational scope.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and display financial analysis data retrieved from the Wind Alice API.
  • Ingestion points: request.js retrieves SSE stream data containing market analysis from the Wind Alice service.
  • Boundary markers: Instructions in SKILL.md require the agent to deliver the output verbatim as received from the CLI, minimizing risks of instruction confusion.
  • Capability inventory: The skill possesses network access for API calls and file writing permissions for downloading reports to the .agents/download/ directory.
  • Sanitization: agentResultSanitize.js identifies server-side resource paths and converts them into local file URLs to provide safe and convenient access for the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 11:59 AM