The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes system commands to facilitate its core functionality and maintenance. Specifically, scripts/wind-alice.mjs spawns a child process for the request logic, and scripts/update-check.mjs executes git and npx commands to check for and install updates.
[DATA_EXFILTRATION]: The skill accesses the user's home directory to read sensitive API keys from %USERPROFILE%\.wind-aifinmarket\config. While this is for the intended purpose of authenticating with the Wind API, it constitutes access to sensitive local credentials.
[EXTERNAL_DOWNLOADS]: The skill automatically fetches report files and attachments from Wind's servers (https://alice.wind.com.cn) and saves them to the local filesystem in the .agents/download/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays raw output (agentResult.value) from the remote Wind Alice API. The instructions specifically forbid the agent from summarizing or rewriting this content, creating a surface where malicious instructions returned by the API could influence the agent's behavior. Evidence found in SKILL.md and scripts/request.js.
[DYNAMIC_EXECUTION]: The skill implements a self-updating mechanism in scripts/update-check.mjs that can dynamically download and execute new versions of the skill using the skills package manager.

wind-alice