T08 · Insecure Dependencies
Warning
- Location
README.md:27- Finding
Unpinned and Inconsistent Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Einstein Research — Macro Regime Detector
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed market-analysis skill that fetches financial data and writes local reports, with cautions around financial advice wording, dependency instructions, and API-key handling.
Install in a dedicated virtual environment, prefer setting FMP_API_KEY in the environment instead of using --api-key, avoid relying on the unsupported Yahoo command until fixed, and treat all portfolio posture output as general market commentary rather than personalized financial advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/macro_regime_detector.py:62- Finding
FMP API Key Can Be Exposed Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a comprehensive multi-factor macro regime detector, but this code chunk is only one component: sector rotation via XLY/XLP. There is no evidence here of the broader regime engine, other asset-ratio analyses, or final regime classification. This is a material purpose mismatch if the chunk is being evaluated as representing the full skill. The code does not show undeclared dangerous behavior or inconsistent permissions; the mismatch is that the actual implemented scope is much narrower than the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code is clearly related to one component mentioned in the description—the yield curve—but the declared purpose describes a multi-factor macro regime detection skill. This chunk does not perform cross-asset regime analysis, does not combine multiple indicators, and does not classify overall market regime states. There is no evidence of undeclared dangerous behavior or inconsistent resource access; the mismatch is that the actual code is materially narrower than the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill detects structural macro regime transitions using multiple financial indicators. However, the supplied code chunk does not implement any market analysis, data access, ratio calculation, or regime identification. It only modifies Python import paths for tests. This is materially different from the declared primary purpose, so the description does not accurately represent the behavior of the provided code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This is a description-behavior mismatch. The description claims a comprehensive macro regime engine combining several cross-asset indicators and producing regime-state identification. The actual code chunk is narrowly focused on tests for one calculator: market concentration via the RSP/SPY ratio. While RSP/SPY concentration is one element mentioned in the description, the supplied code does not implement or exercise the broader regime framework, additional indicators, or final regime classification. There is no evidence of undeclared dangerous behavior or unexpected permissions/resources; the mismatch is that the declared primary purpose is much broader than what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description claims a comprehensive macro regime detection skill that identifies regime shifts across several dimensions and classifies markets into named states. The provided code chunk does not implement that broader capability. It is a unit test file focused narrowly on one indicator: credit conditions via the HYG/LQD ratio. While credit conditions are mentioned in the declared description, this chunk alone does not support the claimed primary purpose of full regime detection or multi-indicator structural analysis. Therefore, the supplied code does not accurately represent the declared skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a high-level macro regime analysis capability with multiple financial inputs and regime-state outputs. The actual code does not implement that behavior; it only contains unit tests for a small helper function that resolves directional labels from crossover and momentum inputs. While such a helper might support a larger financial-analysis system, this chunk by itself does not perform the declared macro regime detection or any of the listed cross-asset analyses. Therefore, the description does not accurately represent this code chunk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill manifest declares no tool scope or allowed tools, yet the documented workflow requires reading environment variables, making outbound API requests, and writing files to disk. This creates an authorization and transparency gap: a reviewer or orchestrator cannot accurately constrain what the skill needs, which can enable over-privileged execution or unexpected data handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide gives direct action-oriented investment instructions such as increasing monitoring, planning adjustments, and executing or completing repositioning without any financial-risk disclaimer or requirement for suitability review. In a skill explicitly designed for macro regime detection and long-term market positioning, this can cause users or downstream agents to treat heuristic signals as personalized investment advice and take actions affecting real assets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code emits concrete portfolio action recommendations such as raising cash, reducing duration, rotating sectors, and finalizing repositioning without any accompanying disclaimer, suitability warning, or requirement for human review. In a market-regime skill explicitly designed for long-term positioning, users may reasonably treat these outputs as actionable financial advice, increasing the chance of harmful decisions based on incomplete, uncertain, or missing data.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill is presented as analysis/reporting, but it instructs creation of JSON and Markdown files on disk. Disk writes increase persistence and data exposure risk, especially if outputs contain market analysis, API-derived content, or user prompts and are written to uncontrolled locations.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill depends on an environment-stored API key but does not declare that credential or external API dependence in the manifest. Undeclared secret usage reduces auditability and can lead to accidental credential exposure, misuse in broader runtimes, or execution in environments where secrets are available but should not be consumed by this skill.
- Content