Einstein Research — Options Strategy Advisor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:18 PM UTC
• Version: 0.1.0

Overview

The skill is an options-analysis tool with purpose-aligned market-data access, but it materially overstates its implemented capabilities and under-specifies its external API and credential handling.

Review before installing. This package does not appear to steal data or execute trades, but it is not the comprehensive options strategy simulator it claims to be. Use it only as an educational Black-Scholes/Greeks helper unless the missing analyzer is added, install dependencies in an isolated environment, and use a limited FMP API key with quota controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Code Snippet:

bash

# Install dependencies
pip install scipy pandas requests

Technical Analysis

The documented installation command installs mutable versions of scipy, pandas, and requests from pip's configured package index. The project does not provide version constraints, a lockfile, package hashes, or an explicit trusted index.

Consequently, installations performed at different times can resolve to different dependency versions that have not been reviewed with the Skill. If a dependency release or configured package source is compromised, attacker-controlled package installation or runtime code could execute with the same privileges as the user running pip or the Skill.

No evidence was found that the currently named dependencies are malicious. This finding concerns the absence of supply-chain integrity controls.

Attack Path

1. An attacker compromises the release process or distribution account of one of the named dependencies, or influences the package index configured in the user's environment.
2. The attacker publishes or substitutes a malicious package version.
3. A user follows the documented unpinned pip install command.
4. Pip resolves and installs the attacker-controlled release because no approved version or hash is required.
5. Malicious code executes during package installation or when the dependency is imported by the Skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user installing or running the Skill. Depending on that user's environment, this could expose accessible files, environment variables, API credentials, and network resources. It would not inherently provide privileges beyond those already held by the affected process, but installation with elevated privileges would incr ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency file with exact versions, such as requirements.txt.
2. Generate and verify cryptographic hashes for every direct and transitive dependency.
3. Install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Document the trusted package index and use an explicit index URL in controlled deployments.
5. Regularly scan pinned packages for known vulnerabilities and update them through a reviewed process.
6. Install dependencies in an isolated virtual environment without administrative privileges.
7. Remove pandas from the installation instructions if it is not required by the supplied implementation.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/black_scholes.py:339

Finding

FMP API Credential Is Transmitted in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: scripts/black_scholes.py:339-343, scripts/black_scholes.py:369-373, and scripts/black_scholes.py:388-392
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Code Snippets:

python

url = f"https://financialmodelingprep.com/api/v3/historical-price-full/{symbol}"
params = {"apikey": api_key}

try:
    response = requests.get(url, params=params, timeout=30)

python

url = f"https://financialmodelingprep.com/api/v3/quote/{symbol}"
params = {"apikey": api_key}

try:
    response = requests.get(url, params=params, timeout=30)

python

url = f"https://financialmodelingprep.com/api/v3/profile/{symbol}"
params = {"apikey": api_key}

try:
    response = requests.get(url, params=params, timeout=30)

Technical Analysis

The requests library serializes the params dictionary into the request URL, producing a query string containing apikey. HTTPS protects the request from ordinary network interception in transit, and all identified requests are restricted to the declared Financial Modeling Prep domain.

Nevertheless, URL query strings are commonly retained by provider access logs, HTTP proxies, monitoring systems, debugging tools, exception telemetry, and browser or gateway history. Any component that records the complete request URL could therefore store the API credential.

The market-data requests are proportionate to the declared stock-price and historical-volatility functionality. The code does not transmit local files, environment variables, unrelated credentials, or other system information. The issue is the credential transport mechanism rather than malicious exfiltration.

Attack Path

1. A user supplies an FMP API key to one of the affected functions.
2. The function places the key in the apikey query parameter.
3. requests constructs and sends a URL containing the credential.
4. FMP in ...[truncated 773 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an HTTP authorization header instead of a query parameter if the FMP API supports header-based authentication.
2. If FMP requires query-string authentication, ensure application, proxy, and monitoring logs redact the apikey parameter.
3. Avoid logging complete prepared request URLs or request objects.
4. Use narrowly scoped API keys with conservative quotas and billing limits.
5. Store keys in an appropriate secret manager or protected environment variable rather than source files or command histories.
6. Rotate exposed keys and provide documented revocation procedures.
7. Catch specific request and JSON exceptions and return sanitized errors that cannot include credential-bearing URLs.
8. Apply the same controls to all three affected FMP integration functions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims broad options analysis, risk management, and strategy simulation features, but the finding indicates the underlying implementation lacks those capabilities while still performing undeclared external API access. This mismatch is dangerous because users may rely on incomplete or nonexistent financial analysis while hidden network behavior occurs outside the declared scope, increasing the chance of unsafe decisions and policy bypass.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill metadata declares no tool scope or allowed tools, yet the documented workflow explicitly runs a Python script that fetches external market data over the network. This creates an undeclared capability gap: users and orchestrators may believe the skill is offline or low-privilege when it can actually make outbound requests, which weakens trust boundaries and review controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The implicit triggers are broad enough to activate the skill for general investing or hedging questions that may not actually require this specific workflow. Over-broad invocation can cause unintended execution paths, including unnecessary external data fetching or delivery of specialized options guidance in contexts where a simpler or safer skill should respond.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring describes a pricing and Greeks calculator with historical volatility support, which suggests computational/analytical behavior. However, the file also includes multiple functions that make outbound HTTP requests to Financial Modeling Prep to fetch quotes, dividend data, and historical prices, expanding behavior beyond the described local pricing engine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill text describes analysis behavior but does not clearly warn that execution may contact external market-data services. Lack of disclosure reduces informed consent and can surprise users or systems operating under privacy, cost, or network-restriction assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring for moneyness states the return values are limited to 'ITM', 'ATM', or 'OTM'. In practice, the function returns 'ATM' or more detailed combined labels such as 'ITM (Call) / OTM (Put)' and 'OTM (Call) / ITM (Put)', which contradicts the documented contract.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.