wind-find-finance-skill

该 skill 的表面目的与实际能力基本一致：它确实是一个安装路由器，而非伪装成分析工具后偷偷做别的事。但其安全足迹偏大：强制执行本地更新脚本、隐藏命令、自动安装其他 skills、在多个远端源之间切换，都会扩大信任边界。未见明确恶意或凭证窃取迹象，但作为一个以“发现/路由”为目的的 skill，它对执行与供应链的控制过强，应判为可疑而非恶意。

The fragment is documentation for a financial skill catalog and its installation/update workflow. It contains no direct evidence of malware, but the recommended unpinned global installation and automatic global updates from external repositories present a meaningful supply-chain risk and broad impact if the upstream content is compromised. Review repository provenance, commit history, package lifecycle behavior, permissions, and pin installations to audited versions or commits before using globally.