wind-mcp-skill

This is an automatic skill updater that reads a source from lock files, downloads content using git or npx skills add, and may replace the installed skill directory. Its version and hash checks provide downgrade and consistency checks but do not authenticate the remote publisher or pin a trusted revision. No credential theft, unrelated exfiltration, or destructive behavior is evident; severity is moderate because a compromised or malicious configured source can deliver code for installation. Relevant paths include scripts/update-state.json and ~/.cache/wind-aifinmarket/locks/; the default source is https://github[.]com/Wind-Alice/AliceMarket[.]git.