wind-one-mcp-skill
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill features a built-in auto-update system that periodically synchronizes with the official Wind-Alice GitHub repository (
https://github.com/Wind-Alice/AliceMarket.git) to ensure the latest financial tools and security patches are applied. - [COMMAND_EXECUTION]: The maintenance scripts utilize the system
gitclient to perform shallow clones of the update repository and use the Node.js runtime to validate script integrity via syntax checks before deployment. - [DYNAMIC_EXECUTION]: The CLI architecture uses dynamic module loading and background process spawning for its update lifecycle, allowing it to perform maintenance tasks without impacting the responsiveness of financial queries.
- [INDIRECT_PROMPT_INJECTION]: As the skill ingests user queries and retrieves live financial data from external market servers, it possesses an indirect prompt injection surface; this is mitigated by instructional boundaries that mandate data verification and source attribution.
Audit Metadata