hithink-finance-financials
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines several instructions for interacting with the
hithink-financeCLI to retrieve financial data. Commands includefinancials income,financials balance-sheet,financials cash-flow, andfinancials indicators. These are the primary intended functions for the vendor-provided tool. - [CREDENTIALS_UNSAFE]: The skill references the use of the
HITHINK_FINANCE_API_KEYenvironment variable and the--api-key-stdinflag for authentication. These methods follow security best practices for credential management by avoiding hardcoded secrets in the instruction files. - [DATA_EXFILTRATION]: The instructions include an
--output <path>parameter for saving financial query results to the local filesystem. This is a standard data management feature for CLI tools and relies on user-specified paths for data persistence. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote financial API via the CLI. While this creates a theoretical attack surface for indirect injection, the skill mitigates this by instructing the agent to use structured JSON formats and to validate parameters against the CLI's official schema using
hithink-finance schema.
Audit Metadata