finta-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides an embedded TypeScript validation script designed to check API connectivity and configuration.\n- [DATA_EXFILTRATION]: The validation script accesses the
FINTA_API_KEYenvironment variable and transmits it to the official Finta API endpoint (api.finta.com) for authentication. This is a functional requirement for verifying the integration.\n- [DYNAMIC_EXECUTION]: The skill includes a local TypeScript script for execution by the agent to perform readiness checks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes investor and financial data, creating a potential surface for indirect prompt injection.\n - Ingestion points: Processes investor communication and deal room metadata described in
SKILL.md.\n - Boundary markers: Instructions explicitly direct the agent to redact sensitive investor and financial data from final outputs.\n
- Capability inventory: Utilizes
fetchfor API interaction and script execution.\n - Sanitization: Requires redaction of PII and financial terms from the final go-live receipt.
Audit Metadata