wind-find-finance-skill
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute shell commands at runtime. Specifically, it mandates running
node scripts/update-check.mjswhenever the skill is triggered to check for updates. It also instructs the agent to executenpx skills addcommands to install additional skills from the vendor's GitHub or Gitee repositories based on user needs. - [REMOTE_CODE_EXECUTION]: The skill implements a self-update mechanism and an installation router. It identifies required dependencies (other skills) from a local catalog and uses
npxto fetch and install them from remote repositories (GitHub/Gitee). This behavior is the primary intended function of the skill, serving as a package manager for the vendor's financial tools. - [DYNAMIC_EXECUTION]: The
scripts/update-check.mjsscript performs dynamic operations to manage updates. It copies itself to a temporary directory (~/.cache/wind-aifinmarket), spawns detached background processes, and executes git commands (git ls-remote) and package management commands (npx skills update). These operations are used for version tracking and ensuring the local skill catalog remains current.
Audit Metadata