finicity
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
okouCLI andjqto interface with banking services. These commands are used to list accounts, balances, and transactions in a read-only manner. Theokoutool is a vendor-provided resource, and the use ofjqis a standard practice for processing structured data. - [INDIRECT_PROMPT_INJECTION]: The skill processes financial transaction data retrieved from external banking providers, which could contain untrusted content.
- Ingestion points: Transaction details and memos retrieved via the
okou banking transactionscommand (SKILL.md). - Boundary markers: No specific delimiters or instructions are provided to the agent to treat data within transaction fields as non-instructional content.
- Capability inventory: The skill possesses the ability to execute shell commands (
okou,jq) to interact with the environment. - Sanitization: The skill uses
jqto select specific JSON fields, providing structural validation, but does not perform content-level sanitization of strings within the transaction data.
Audit Metadata