openfin-setup
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted data from both the user and external API responses.\n
- Ingestion points: User input provided during the API key request in SKILL.md and JSON response data from the
GET /agent/walletsendpoint.\n - Boundary markers: The agent is instructed to validate that the key follows the
open_prefix format.\n - Capability inventory: The skill performs network operations (HTTP GET) to the vendor's domain
https://openfinance.tech.\n - Sanitization: The instructions include checking for specific JSON fields (
ethereum,solana) and handling error codes like 401 and 412 to verify the key's validity and provisioning status.
Audit Metadata