wind-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes natural language queries from users and fetches data from external Wind API endpoints. This creates a surface for indirect prompt injection if the remote data contains adversarial instructions, which is a common low-level risk for data-retrieval skills. Every Cat 8 evidence chain: Ingestion point in 'server.py' via user-supplied 'question' and 'query' params; Boundary markers are limited to instructions in 'SKILL.md' to remove whitespace; Capability inventory includes network requests to 'mcp.wind.com.cn'; Sanitization is not explicitly implemented in the local proxy script.
- [COMMAND_EXECUTION]: The skill's error handling documentation ('references/error-codes.json') and fallback guides ('references/fallback-alice.md') instruct the agent to execute shell commands such as 'node scripts/cli.mjs' and 'npx skills add'. While these are intended for setup and recovery, they involve execution of external scripts and tools.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The 'server.py' script is designed to read API keys from '~/.wind-aifinmarket/config'. While this involves accessing a sensitive path, it is a standard practice for managing persistent credentials required for the skill's functionality.
- [EXTERNAL_DOWNLOADS]: The documentation references external resources from the vendor's official repositories on GitHub and Gitee. These are recognized as legitimate vendor resources and do not escalate the security risk.
Audit Metadata