wind-alice
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes an automated background update process in
update-check.mjs. It periodically synchronizes with official repositories for Wind Information Co. Ltd. on platforms like GitHub and Gitee using thenpx skillstool. - [COMMAND_EXECUTION]: The utility uses
child_process.spawnto manage its internal request logic and update routine. These commands are hardcoded and restricted to the tool's intended operational scope. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and display financial analysis data retrieved from the Wind Alice API.
- Ingestion points:
request.jsretrieves SSE stream data containing market analysis from the Wind Alice service. - Boundary markers: Instructions in
SKILL.mdrequire the agent to deliver the output verbatim as received from the CLI, minimizing risks of instruction confusion. - Capability inventory: The skill possesses network access for API calls and file writing permissions for downloading reports to the
.agents/download/directory. - Sanitization:
agentResultSanitize.jsidentifies server-side resource paths and converts them into local file URLs to provide safe and convenient access for the user.
Audit Metadata