hithink-finance-research

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns or security risks were identified. The skill operates within the scope of financial research as intended by the vendor.\n- [COMMAND_EXECUTION]: The skill executes commands using the hithink-finance CLI, which is a legitimate tool provided by the author hithink-tech. These commands include data validation, database queries, and panel exports.\n- [DYNAMIC_EXECUTION]: The skill facilitates the execution of dynamic SQL queries through the hithink-finance db query and db export commands to perform descriptive statistics and data exports. This is a primary function of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it processes external database content. 1. Ingestion points: Local database files provided via the --db path in references/research-workflow.md. 2. Boundary markers: None identified in the prompt instructions. 3. Capability inventory: Includes database querying, data export, and file existence checks via the hithink-finance CLI. 4. Sanitization: Relies on the read-only SQL requirement and CLI implementation; no instruction-level sanitization is present.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 04:57 AM