T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/capital_gains_estimator.py:42- Finding
Standalone Capital-Gains Calculator Ignores the Long-Term Capital-Gains Exemption
- Content
View full analysis
= int(rule['long_term_days']) rate = float(rule['lt_rate'] if long_term else rule['st_rate']) taxable = max(0.0, gain) tax = round(taxable * rate, 2) ``` The incorrect behavior is explicitly preserved by the test at `scripts/test_suite.py`, lines 106-116: ```python def test_capital_gains_lt(): r = run('capital_gains_estimator.py', { 'fy': 'FY-2026-27', 'asset_type': 'equity_stt_paid', 'gain': 50000, 'holding_days': 400 }) assert r['result']['classification'] == 'long_term' assert_approx(r['result']['estimated_tax'], 6250, msg="LTCG equity") # 12.5% of 50K (above 1.25L exemption, but 50K < 1.25L so... wait) # Actually 50K gain is below 1.25L exemption, so tax should be 0! # But the script doesn't apply the exemption, it just applies the rate # This is a known simplification; the exemption is applied in full_tax_estimator print("PASS: capital_gains_lt (rate check)") ``` ### Technical Analysis The calculator determines whether a gain is long-term and selects the corresponding rate, but applies that rate to the entire positive gain. It does not read or apply the rule's `lt_exemption_limit`. Consequently, an amount that falls entirely within the verified exemption can still be reported as taxable. The test suite confirms that this is known behavior and treats the incorrect result as passing. The script is described as a capital-gains tax estimator rather than only a rate lookup. Its output fields—`taxable_gain_used` and `estimated_tax`—can therefore reasonably be interpreted as an estimated liability. ### Attack Path 1. A user supplies an equity capital gain below the configured long-term exemption. 2. The user supplies a holding period that cl ...[truncated 865 chars]- Remediation
View remediation