Security audit

Options Brain

Security checks across malware telemetry and agentic risk

Overview

This skill is a small remote financial-signal fetcher, but it is marketed as deep analysis while sending tickers to an external service and returning crypto-payment instructions for premium results.

Review carefully before installing. The artifact does not show file theft, credential access, persistence, or destructive behavior, and VirusTotal/static scan signals are clean. The main concern is trust and transparency: ticker queries go to an external financial-signal service, results are opaque, and premium access asks for direct cryptocurrency payment. Treat any output as third-party trading content, not independently verified analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable usage that performs external network access, but the manifest does not declare the corresponding permission. Hidden or undeclared network capability undermines review and sandbox policy enforcement, making it harder for users and hosts to understand what data leaves the environment and what third parties are contacted. In this context, the skill is more dangerous because it presents itself as analytical tooling while implicitly depending on off-platform calls for results.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose is market analysis, but the behavior described is materially different: it fetches opaque third-party 'signals' and includes a payment solicitation, reportedly with cryptocurrency wallet and pricing details. This mismatch is dangerous because it can deceive users and reviewers about what the skill actually does, enabling undisclosed monetization, exfiltration to third parties, or scam-like signal vending under the guise of analysis. The context increases risk because financial-trading users may make high-impact decisions based on unverifiable external outputs.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill advertises deep options-activity analysis, but the implementation simply forwards a ticker to a remote endpoint and returns the result unchanged. This is dangerous because users and downstream agents may rely on a claimed analytical capability that does not exist, while exposing their query to an unvetted external service and trusting opaque output as if it were locally derived analysis.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The @tool description claims specialized, deep analysis of unusual options activity and walls, but the function only proxies a remote API response. In agent ecosystems, this mismatch can mislead users into granting trust, making trading or risk decisions based on unverifiable third-party data presented as expert analysis.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The code sends the user-supplied ticker to an external domain without any disclosure, consent, or privacy notice in the skill. While a ticker is usually low-sensitivity data, the behavior still creates an unnecessary data-sharing boundary and can reveal user interests or strategies to a third party, especially in financial contexts.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.