hithink-finance

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to install the official CLI tool using npm install -g @hithink-tech/hithink-finance-cli and to manage its internal capability synchronization by copying skill directories from a local source into the agent's environment.
  • [PERSISTENCE]: The setup documentation includes shell commands for the user to append the HITHINK_FINANCE_API_KEY to configuration files like ~/.bashrc and ~/.zshenv, which is a standard procedure for ensuring persistent environment variables for CLI tools.
  • [DATA_EXFILTRATION]: The skill performs legitimate network operations to the vendor's API endpoints at fuyao.aicubes.cn to retrieve stock market data, financial statements, and fund information. It also fetches pre-signed S3 download URLs for large Parquet-formatted datasets.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the financial API and local DuckDB databases. While this creates a potential attack surface for indirect prompt injection, the skill utilizes structured data formats (JSON/Parquet) and specific processing logic to handle these data streams securely.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 05:43 AM
Security Audit — agent-trust-hub — hithink-finance