hithink-finance
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to install the official CLI tool using
npm install -g @hithink-tech/hithink-finance-cliand to manage its internal capability synchronization by copying skill directories from a local source into the agent's environment. - [PERSISTENCE]: The setup documentation includes shell commands for the user to append the
HITHINK_FINANCE_API_KEYto configuration files like~/.bashrcand~/.zshenv, which is a standard procedure for ensuring persistent environment variables for CLI tools. - [DATA_EXFILTRATION]: The skill performs legitimate network operations to the vendor's API endpoints at
fuyao.aicubes.cnto retrieve stock market data, financial statements, and fund information. It also fetches pre-signed S3 download URLs for large Parquet-formatted datasets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the financial API and local DuckDB databases. While this creates a potential attack surface for indirect prompt injection, the skill utilizes structured data formats (JSON/Parquet) and specific processing logic to handle these data streams securely.
Audit Metadata