Options Trading Backtester

• Outcome: Review
• Latest audit: Jun 5, 2026 at 1:26 PM UTC
• Version:
  1.0.15

Overview

This is not malware, but the finance skill presents randomized demo results as broader historical options backtesting, which could mislead users making trading decisions.

Review this carefully before installing. Treat it as a synthetic demo only, not a real options backtester, and do not use its output to place trades or evaluate strategy performance unless the implementation is corrected to use validated market data, strategy-specific logic, and enforced risk filters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises support for multiple options strategies and historical or real-data backtesting, but the implementation only performs a randomized iron condor simulation and never loads real market data. In a finance skill, this is dangerous because users may make trading decisions based on fabricated or misleading results, creating a high risk of financial harm through misplaced trust in the tool's claimed capabilities.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims the backtester rejects low-IV setups, wide bid-ask spreads, and near-expiry trades, but the code enforces none of these risk controls. In a trading/backtesting context, missing these filters can materially distort performance outputs and encourage unsafe strategies by presenting results as if realistic safeguards were applied.

VirusTotal

65/65 vendors flagged this skill as clean.