iFinD-Finance-Data
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The Python script
call.pydefines a dependency on therequestslibrary for handling HTTP communications. - [COMMAND_EXECUTION]: Both the Python (
call.py) and Node.js (call-node.js) scripts perform network operations to the vendor's API atapi-mcp.51ifind.com. These scripts include code that explicitly disables SSL/TLS certificate verification (verify=Falsein Python andrejectUnauthorized: falsein Node.js), creating a vulnerability to man-in-the-middle (MITM) attacks. - [PROMPT_INJECTION]: The skill ingests and processes external data (financial indicators, news, and announcements), which serves as an attack surface for indirect prompt injection.
- Ingestion points: API response data retrieved from iFinD servers and processed within
call.pyandcall-node.js. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the scripts or instructions.
- Capability inventory: The skill possesses network communication capabilities via the provided scripts to interact with the iFinD MCP servers.
- Sanitization: The skill does not implement validation or sanitization of the data retrieved from external API endpoints before passing it to the agent context.
Audit Metadata