hithink-finance-valuation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
hithink-financecommand-line utility to perform its functions, specifically using thevaluation snapshot,capabilities, andschemacommands. These are vendor-provided tools intended for the skill's primary purpose. - [DATA_EXFILTRATION]: The skill facilitates data movement by querying external financial APIs (requiring an API Key) and optionally writing results to the local file system using the
--outputparameter. This behavior is documented and consistent with the skill's utility for processing financial metrics. - [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from an external financial API, which represents an attack surface where malicious content in the data could potentially influence agent behavior.
- Ingestion points: The skill ingests data via the
hithink-finance valuation snapshotcommand output (referenced inreferences/valuation-snapshot.md). - Boundary markers: Instructions are provided to the agent to report only summaries or file paths when dealing with large datasets, which limits the volume of untrusted data directly interpreted by the agent.
- Capability inventory: The agent has the capability to execute the
hithink-financeCLI and write files to disk via command parameters. - Sanitization: The skill implements input validation by limiting tokens to 100 and performing de-duplication, though it does not explicitly define sanitization for the content of the API response itself.
Audit Metadata