Ibkr Trader Toolkit Deprecated

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 0.2.4

Overview

The skill is presented as a deprecated redirect, but the package still includes active Interactive Brokers account-analysis and trading scripts, including order cancellation and live order placement paths.

Do not install this deprecated slug as an operational skill. Use the renamed package only if you intentionally want a broker-connected assistant, understand that portfolio and account data may enter the agent context, keep IB Gateway in paper or read-only mode unless you explicitly intend trading, and treat trade.py cancellation/order commands as real account actions. Prefer pinned releases and locked dependency hashes before using it with a live account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Mutable and Unhashed Third-Party Dependencies Permit Supply-Chain Code Execution

Content

View full analysis

=2.2,<3 numpy>=2.0,<3 pyyaml>=6.0 python-dotenv>=1.0 requests>=2.31 ibflex>=0.16 ``` The documented installation procedure executes: ```bash git clone https://github.com/AlexLiu0130/ibkr-options-assistant.git cd ibkr-options-assistant python -m venv .venv source .venv/bin/activate pip install -r requirements.txt ``` The deprecated Skill also redirects users to a mutable Git repository: ```bash git clone https://github.com/AlexLiu0130/ibkr-options-assistant.git \ ~/.claude/skills/ibkr-options-assistant ``` ### Technical Analysis Six direct dependencies use version ranges rather than exact versions, and none of the dependencies is protected by a cryptographic package hash. Consequently, two installations performed at different times may resolve to different package artifacts that were not included in or validated by this audit. Although `ib_async` is exactly version-pinned, it is also not hash-pinned, and its transitive dependencies are not locked. Exact version pinning alone does not verify that the downloaded artifact is the expected artifact. The installation documentation also clones the default branch of an external GitHub repository rather than an immutable commit or signed release. This permits the effective code installed by a user to change after the reviewed Skill package was published. No evidence was found that the currently declared packages are malicious, typosquatted, or intentionally compromised. The vulnerability is the absence of controls that would prevent a future upstream or package-index compromise from becoming local code execution. ### Attack Path 1. An attacker compromises an upstream package maintainer account, package-index p ...[truncated 1731 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (133)

Tainted flow: 'req' from os.getenv (line 56, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/earnings_calendar.py (reported line 61)May include surrounding context.

python

"Accept": "application/json",
        })
        try:
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())
        except Exception as e:
            log(f"  Nasdaq {d}: {e}")
            continue

Tainted flow: 'url' from os.getenv (line 85, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/earnings_calendar.py (reported line 87)May include surrounding context.

python

})
    url = f"https://finnhub.io/api/v1/calendar/earnings?{params}"
    try:
        with urllib.request.urlopen(url, timeout=10) as resp:
            data = json.loads(resp.read())
    except Exception as e:
        log(f"  Finnhub {symbol}: {e}")

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata says this deprecated skill should not run scripts and should only redirect users to a renamed package, but this file still implements a fully functional live-trading entrypoint that can place, cancel, and list IBKR orders. In a deprecated redirect-only skill, retaining executable real-money trading logic creates a dangerous capability mismatch: users, agents, or tooling may invoke functionality that should no longer exist, leading to unintended order placement and financial loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file retains real-money trading and order-management capabilities that are not justified by the skill's declared purpose as a deprecated redirect-only package. Even with safety gates, the presence of live execution, cancellation, and order inspection code expands the attack surface and enables misuse if an agent, wrapper, operator, or environment accidentally supplies the required flags or environment variables.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description for this skill states that if invoked, no scripts should be run and the user should instead be told to install ibkr-options-assistant. However, this changelog explicitly says the rename left scripts and behavior unchanged, and the rest of the file documents many active operational scripts. That is a direct mismatch between the deprecated manifest intent and the skill's actual documented behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A skill whose manifest says it is deprecated and should only tell users to install a replacement has no justified need to retain live trading capabilities. These lines describe trade.py, including non-readonly broker access and order placement/cancellation functionality, which is far beyond a redirect-only purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The README instructs users to clone, configure, and run the deprecated skill's scripts even though the skill metadata explicitly says this package is deprecated and, if invoked, no scripts should be run and users should instead be redirected to the renamed skill. This mismatch is dangerous because an agent may follow the README and execute local broker-connected tooling despite the higher-priority deprecation safety instruction, increasing the chance of unintended access to account data or order-capable functionality.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md

> [中文版 README](README.zh-CN.md)

<!-- screenshot: hero -->

---

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README disclaimer says the repo never calls placeOrder() and is read-only, but earlier sections explicitly document trade.py as an order-placing script with opt-in gates. Contradictory safety claims around live brokerage access are dangerous because users or agents may underestimate execution risk and enable or invoke trading features under a false assumption that the toolkit cannot place orders.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The README instructs users how to install and use a live IBKR trading-analysis skill, but the manifest explicitly says this deprecated skill must not run scripts and should redirect users to a different skill. This mismatch can cause an agent to ignore the deprecation boundary and invoke local scripts against brokerage-connected tooling, defeating the intended safety/control plane.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 201)May include surrounding context.

4. 配置环境变量

bash

cp .env.example .env
$EDITOR .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 178)May include surrounding context.

4. 配置环境变量

bash

cp .env.example .env
$EDITOR .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 202)May include surrounding context.

bash

cp .env.example .env
$EDITOR .env

需要确认的最小字段（默认通常就行）：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 179)May include surrounding context.

bash

cp .env.example .env
$EDITOR .env

需要确认的最小字段（默认通常就行）：

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims the repository is read-only and never calls placeOrder(), yet elsewhere it documents a trade.py script that can place orders when gates are enabled. Contradictory security claims are dangerous because agents or users may trust the weaker statement and underestimate the presence of trading-capable code connected to a real brokerage session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear mismatch. The description explicitly states the skill is deprecated and should not run any scripts, only instruct users to install a different skill. In contrast, the supplied code implements a real IBKR alerts monitor with substantial functionality: loading YAML rules, connecting to IBKR, inspecting positions, fetching spot prices and option metrics, safely parsing and evaluating expressions, and producing JSON alert results. These are not incidental implementation details; they constitute the primary purpose of the code and materially differ from the declared purpose. The code also accesses resources and performs actions that are undeclared, including local file reads, brokerage/network access, and file output.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose says this skill is deprecated and, if invoked, should only tell the user to install another skill and should not run any scripts. In contrast, the code is an active analysis tool: it parses arguments, optionally connects to IBKR, fetches positions, reads files, computes concentration metrics, and writes results. This is a materially different primary purpose and introduces undeclared capabilities and resource access (live brokerage connection, file I/O, portfolio analysis).

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is deprecated and should not run any scripts, only tell the user to install a replacement skill. The actual code is not a deprecation notice or redirect handler; it is substantive financial/instrument-resolution code used to map symbols into IBKR contract objects. Although this particular chunk does not itself perform network access or trading, its primary purpose is clearly functional support for an IBKR-related skill, not a passive deprecation mechanism. That is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch. The declared description says this skill is deprecated, should not run any scripts, and should merely direct the user to install another skill. The actual code does the opposite: it is an operational script with a distinct purpose—calculating effective cost basis for wheel-strategy positions. It accesses broker session data, local CSV history, processes fills and positions, and produces output. These are material undeclared capabilities and a materially different primary purpose from the declared deprecation-only behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear mismatch. The declared purpose is effectively a deprecation notice with behavioral instruction: do not execute functionality, only direct the user to another skill. The supplied code instead implements substantive functionality unrelated to a deprecation redirect. Its primary purpose is earnings-date retrieval and portfolio risk analysis, including network access and local file I/O, none of which are reflected in the declaration. The absence of declared permissions also conflicts with the code’s actual use of external HTTP requests and filesystem reads/writes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose says the skill is deprecated, renamed, and should not execute scripts at all; it should only tell the user to install another skill. In contrast, the actual code is an operational utility script whose primary purpose is to load local IBKR Flex statement files, parse CSV/XML trade data, normalize and filter trades, and emit JSON output. While the script does not appear to make network connections and only accesses local files, its existence and functionality materially contradict the declared behavior of doing nothing except redirecting the user elsewhere.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear mismatch. The declared purpose explicitly states that the skill is deprecated and that no scripts should be run; instead, it should only tell the user to install a different skill. The supplied code does the opposite: it contains active brokerage integration logic for connecting to Interactive Brokers, managing client IDs, making historical data requests, and qualifying contracts. These are substantive runtime capabilities unrelated to a simple deprecation/redirect notice.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose says the skill is deprecated and should only tell users to install another skill, explicitly stating not to run any scripts. However, the supplied code actively implements quote lookup: it resolves symbols into IBKR contract types, connects to IBKR, requests historical data, and returns pricing/details in JSON. That is a substantive operational capability and a different primary purpose than mere deprecation/redirection. The code also uses external broker/data access, which is inconsistent with the empty declared permissions and the stated behavior of doing nothing except redirecting the user.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is purely deprecation guidance: if invoked, the skill should not execute scripts and should only redirect the user to install another skill. In contrast, the code is a fully functional options analysis tool with substantial behavior: parsing CLI arguments, reading JSON files, optionally connecting to Interactive Brokers, fetching market data, computing volatility context, selecting and pricing strategies, and emitting results. This is not a minor implementation detail of a redirector; it is a materially different primary purpose with undeclared data access and execution capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declaration says the skill is deprecated and should not run scripts at all; it should only instruct the user to install another skill. In contrast, the code is a fully operational command-line utility for fetching options chains from IBKR, including live prices and Greeks, and optionally writing results to disk. That is a materially different primary purpose and introduces undeclared external access and execution behavior. The mismatch is not a minor implementation detail; the code directly contradicts the declared instruction not to run scripts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.