wind-mcp-skill
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes an automated update mechanism in
scripts/update-check.mjsthat checks for newer versions of the skill from the vendor's official repositories on GitHub and Gitee. - [COMMAND_EXECUTION]: The
scripts/cli.mjsandscripts/update-check.mjsscripts use thespawnandspawnSyncmodules to perform routine operations such as opening a browser for API key management and executing the standard skill update command vianpx. - [DYNAMIC_EXECUTION]: The skill implements a self-updating feature that can download and install updates to its own source code and documentation. This process includes integrity checks using SHA-256 hashing to ensure data consistency during the update process.
- [CREDENTIALS_SAFE]: The skill handles authentication by reading a
WIND_API_KEYfrom environment variables, local configuration files, or a specific directory in the user's home folder (~/.wind-aifinmarket/config). It correctly masks keys in logs and provides a dedicated command to securely set up credentials with appropriate file permissions.
Audit Metadata