xhcj-finance

• Analyzed: May 17, 2026, 6:11 AM
• Findings: 1
• Version: 1.0.8
• Hash: 937792d98f77048d2de5f1511d2a6bd5b611996a3cbb899d6f760188ac0eed58
• Source: palm
• External report: View on VirusTotal

Findings (1)

The xhcj-finance skill is a legitimate CLI tool for querying Xinhua Finance market data and news. The code in index.js follows its stated purpose, implementing basic security measures such as masking API keys in logs and hashing the key before using it as a Bearer token for requests to the official cnfin.com domain. No evidence of data exfiltration, malicious execution, or prompt injection was found.