finhay-market
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the Finhay API through a local shell script (
finhay.sh) or PowerShell script (finhay.ps1). This is the intended design for facilitating API requests from the agent and is implemented in a controlled manner. - [CREDENTIALS_UNSAFE]: The skill does not contain any hardcoded API keys or secrets. It follows security best practices by requiring users to configure
FINHAY_API_KEYandFINHAY_API_SECRETas environment variables or via an interactive authentication command. - [DATA_EXFILTRATION]: Network communication is limited to official Finhay Securities API endpoints for retrieving market data. The skill includes a transparent attribution mechanism (
AGENT_NAME) to identify the calling tool to the API provider. - [SAFE]: The skill ingests external content from financial news articles and recommendation reports. While this represents a standard surface for potential indirect prompt injection, the data is sourced from official financial feeds and the skill does not grant any high-risk capabilities that could be exploited through this data.
Audit Metadata