The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implements an automatic background update feature in scripts/update-check.mjs. It fetches updates from the Wind-Alice repository on GitHub or Gitee to ensure the financial data tools remain current.
[DYNAMIC_EXECUTION]: The updater routine replaces the skill's own directory with newly downloaded content after verifying the version and integrity. This self-modification is a core part of the skill's maintenance workflow.
[COMMAND_EXECUTION]: The CLI utility (scripts/cli.mjs) executes the ps command to identify the AI agent calling the skill, which is used to set the appropriate User-Agent for network requests. Additionally, it uses system commands to open the user's browser for API key management.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by ingesting data from external financial documents and news sources through tools like get_company_announcements and get_financial_news.
Ingestion points: External text data is retrieved from Wind services via the financial_docs server.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this ingested content as untrusted.
Capability inventory: The skill includes file system access for configuration and subprocess execution for its CLI functionality.
Sanitization: The skill performs standard JSON processing of the data but does not implement instruction-level sanitization for the LLM.

wind-mcp-skill