hithink-finance-valuation

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the hithink-finance command-line utility to perform its functions, specifically using the valuation snapshot, capabilities, and schema commands. These are vendor-provided tools intended for the skill's primary purpose.
  • [DATA_EXFILTRATION]: The skill facilitates data movement by querying external financial APIs (requiring an API Key) and optionally writing results to the local file system using the --output parameter. This behavior is documented and consistent with the skill's utility for processing financial metrics.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from an external financial API, which represents an attack surface where malicious content in the data could potentially influence agent behavior.
  • Ingestion points: The skill ingests data via the hithink-finance valuation snapshot command output (referenced in references/valuation-snapshot.md).
  • Boundary markers: Instructions are provided to the agent to report only summaries or file paths when dealing with large datasets, which limits the volume of untrusted data directly interpreted by the agent.
  • Capability inventory: The agent has the capability to execute the hithink-finance CLI and write files to disk via command parameters.
  • Sanitization: The skill implements input validation by limiting tokens to 100 and performing de-duplication, though it does not explicitly define sanitization for the content of the API response itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 04:57 AM