hithink-finance-options
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
hithink-financecommand-line tool with various subcommands (varieties,contracts,intraday,daily, etc.) to fetch financial data. These operations are consistent with the skill's primary purpose. - [DATA_EXPOSURE]: The instructions describe the use of an API key for remote calls, directing the agent to follow shared rules for credential management rather than hardcoding or exposing secrets. This is a standard security practice.
- [FILE_SYSTEM_ACCESS]: The skill advises using an
--output <path>parameter to save large data results to the local filesystem. This is a legitimate operational practice for handling voluminous financial data to avoid overwhelming the agent's context window. - [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting external financial market data. While this provides a theoretical surface for indirect prompt injection if the market data were to contain malicious instructions, the skill implements boundary checks by requiring the agent to verify command schemas and help documentation before execution, which serves as a mitigating factor.
Audit Metadata