[beepboop2025]

Plugin Submission

Plugin information

• Author: beepboop2025
• Plugin name: financial_evidence
• Version: 0.1.2
• Source repository: https://github.com/beepboop2025/financial-evidence-skills/tree/8c3baac2c9a06c97d243d3d068dc364ce4d951d0/integrations/dify
• Contact: mrinal@liquilens.in

Submission type

• New plugin
• Version update

What changed

Move fixed public research requests to the central hosted service at
https://agents.seiche.info/v1/research/api/v1/query. Declare this outbound domain
and explain the central service's operational data handling. The existing
seven datasets, bounded selectors and complete evidence JSON contract remain
unchanged. This is an upstream-service migration, with no new product account,
API key, LLM provider, storage permission or financial transaction.

Breaking-change note: tool inputs and output schema are unchanged. Deployments
with outbound network allowlists must permit agents.seiche.info; allowing only
the old api.seiche.info host is insufficient for this version.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

The optional entity selector is user-provided text sent to the fixed HTTPS
endpoint above. Use public entity identifiers only; do not submit customer,
account, personal or other private financial data. Dataset is allowlisted;
entity length is at most 100 characters, limit is 1..100, offset is 0..100000.
The URL is a module constant, not user-controlled. Redirects are disabled and
requests time out after 30 seconds. The plugin does not execute commands or
code, run SQL, use SSH/SFTP, operate on filesystems, automate browsers, proxy
arbitrary URLs, or process uploaded files. It has no transaction capability.
The central service records bounded operation/tool/dataset demand; selectors,
credentials and response bodies are excluded from those demand dimensions.
Read PRIVACY.md for network metadata, hosting, retention and Dify workflow logs.
No LLM call or independent telemetry is added by this plugin.

Local validation

Exact archive: financial_evidence-0.1.2.difypkg, 7477 bytes.
SHA256: 350d20409d9a3287d0ddc1b939d2cbb5f577ca632f2c20be75a5c7d046f0ba96.
All ten archive files match the declared source. Official Marketplace Toolkit
revision 57a21d1304b1108df3e6b90a15a4f5dd9f0915f9 is used with:

python3 validator/validate-difypkg.py financial_evidence-0.1.2.difypkg   --output-dir validation-report-submission --pr-body-file submission-body-final.md

Current validation completed with zero blocking failures, zero execution failures
and five warning categories; the online OSV check reported no known vulnerabilities
for the two directly pinned dependencies. This is not a transitive dependency audit.
The final PR body and package were revalidated with the same zero-blocking result. Existing SDK/package qualification
is recorded in docs/platforms/hosted-native-packages.json and is distinct from
execution inside Dify.

Reviewer notes

Native Dify Cloud verification of this exact 0.1.2 archive completed on 2026-10-28
(Asia/Kolkata) in a SANDBOX workspace using Local Package File installation.
An unpublished User Input → Get Evidence Page → Output workflow preserved the
complete JSON array. Public-data cases money_markets, bank_risk and
market_liquidity all succeeded with limit 1, offset 0, blank entity, three steps
and zero model tokens. A separate market_liquidity invocation also succeeded
with a distinct native run ID. An accidentally entered limit 251 was rejected
with the explicit integer 1..100 bounds error and no evidence output; no source
error is inferred from this operator-input correction.

Case	Live elapsed	Original UI-copied JSON SHA256
money_markets	9.421s	26104fb04cf533267d08ab937e4c86f54af3cd889e0b9c318bfe2ac8e6ae105a
bank_risk	1.175s	cac0dbad6209b10e36d8133a85e33c5a4510bf8b0fe26c501b415c77f6b765d8
market_liquidity	0.759s	4426105d52cf7bab5b4a7451b56cd2d58fecf4ea5d10afe33a58a7820be9e24e
market_liquidity repeat	0.864s	02ada3d829602faa4fb374139bece1eb6c50ee2fb04992b8ba4abbccbcd2f02b

The output contracts, original hashes and row bounds were independently checked.
The repeat was a separate Dify execution of cached provider evidence, not a fresh
upstream retrieval. Money-market source status PARTIAL, bank construction-PIT
status and unknown rights, and the market-liquidity null/unavailable value and
failed stress-case limitation remain unchanged in the outputs. Transport/native
success does not establish evidence validity, freshness, licensing, financial
authority, regulatory compliance or customer adoption.

The temporary unpublished workflow and test installation were removed afterward;
the baseline workspace integrations were preserved. Community Edition was not
tested. Dify Cloud's precise deployed version was not exposed; no minimum Dify
version is asserted. These are documented platform limitations, not CE acceptance.

Static transaction matches refer to explicit denials of transaction authority;
the implementation performs only a fixed HTTPS GET. Document the runtime-built
URL warning as a fixed module constant. Preserve the old 0.1.1 package when
adding the single 0.1.2 archive to the existing publisher directory.

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the submitted package, documentation, and relevant source; this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.