flashalpha-options-analytics

Security Findings (153)

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at vsmithery: 71 tool(s) added, 29 tool(s) removed without a version bump.

  + 71 added

  calculate_greekscalculate_kellyget_accountget_advanced_volatilityget_chexget_dealer_premiumget_dexget_dispersionget_earningsget_earnings_calendarget_earnings_screenerget_expected_moveget_exposure_basketget_exposure_sheetget_exposure_summaryget_flow_dealer_riskget_flow_levelsget_flow_liveget_flow_pin_riskget_flow_scanget_flow_signalsget_flow_summaryget_gexget_historical_advanced_volatilityget_historical_chexget_historical_coverageget_historical_dexget_historical_exposure_summaryget_historical_gexget_historical_levelsget_historical_max_painget_historical_narrativeget_historical_option_quoteget_historical_stock_quoteget_historical_stock_summaryget_historical_surfaceget_historical_vexget_historical_volatilityget_historical_vrpget_historical_zero_dteget_levelsget_liquidityget_max_painget_narrativeget_oi_diffget_option_chainget_option_flowget_option_quoteget_skew_termget_spot_vol_correlationget_stock_flowget_stock_quoteget_stock_summaryget_strategyget_surfaceget_svi_paramsget_symbolsget_term_structureget_tickersget_universeget_vexget_vix_stateget_volatilityget_vrpget_vrp_historyget_zero_dteget_zero_dte_flowpost_screenerpost_structure_greekspost_structure_pnlsolve_iv

  − 29 removed

  estimate_exit_ruleget_available_datesget_contract_marksget_contract_snapshotget_daily_reportget_earnings_windowget_enriched_signal_schemaget_enriched_signalsget_freemium_previewget_harvest_curveget_historical_performanceget_market_calendar_statusget_opportunity_surfaceget_outcome_summaryget_overnight_signalsget_playbookget_pool_featuresget_pool_liquidityget_position_historyget_regime_contextget_report_listget_signal_detailget_signal_explainerget_signal_performanceget_win_rate_summarylist_playbooksquery_outcomesreplay_contractweb_search

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• HighAS-003

  🔀Scope Mismatch

  get_liquidity:tool name "get_liquidity" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×3

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  get_liquidityget_option_quoteget_oi_diff

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-010

  🔑Insecure Secret Handling ×71

  input parameter "apiKey" accepts a credential (informational; not evidence of insecure handling)

  get_strategyget_vix_stateget_surfaceget_stock_summaryget_stock_flowget_historical_exposure_summarypost_screenerget_historical_advanced_volatilityget_historical_chexget_tickersget_levelsget_flow_scanget_vrpget_expected_moveget_advanced_volatilityget_historical_levelsget_vrp_historyget_historical_narrativepost_structure_greeksget_accountget_spot_vol_correlationget_svi_paramsget_exposure_basketget_exposure_sheetget_liquidityget_flow_signalsget_narrativeget_historical_max_painget_option_chainpost_structure_pnlget_exposure_summaryget_historical_vrpget_historical_option_quoteget_universeget_historical_volatilityget_historical_stock_summaryget_zero_dteget_vexget_earnings_calendarget_dealer_premiumget_dispersionget_gexget_dexcalculate_greeksget_option_quoteget_flow_levelsget_flow_summaryget_earnings_screenerget_term_structureget_symbolsget_historical_coverageget_volatilityget_chexget_historical_zero_dteget_flow_pin_riskcalculate_kellyget_option_flowget_flow_liveget_historical_surfaceget_earningsget_oi_diffget_flow_dealer_riskget_skew_termget_historical_dexsolve_ivget_stock_quoteget_max_painget_historical_vexget_historical_stock_quoteget_zero_dte_flowget_historical_gex

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×71

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  get_strategyget_vix_stateget_surfaceget_stock_summaryget_stock_flowget_historical_exposure_summarypost_screenerget_historical_advanced_volatilityget_historical_chexget_tickersget_levelsget_flow_scanget_vrpget_expected_moveget_advanced_volatilityget_historical_levelsget_vrp_historyget_historical_narrativepost_structure_greeksget_accountget_spot_vol_correlationget_svi_paramsget_exposure_basketget_exposure_sheetget_liquidityget_flow_signalsget_narrativeget_historical_max_painget_option_chainpost_structure_pnlget_exposure_summaryget_historical_vrpget_historical_option_quoteget_universeget_historical_volatilityget_historical_stock_summaryget_zero_dteget_vexget_earnings_calendarget_dealer_premiumget_dispersionget_gexget_dexcalculate_greeksget_option_quoteget_flow_levelsget_flow_summaryget_earnings_screenerget_term_structureget_symbolsget_historical_coverageget_volatilityget_chexget_historical_zero_dteget_flow_pin_riskcalculate_kellyget_option_flowget_flow_liveget_historical_surfaceget_earningsget_oi_diffget_flow_dealer_riskget_skew_termget_historical_dexsolve_ivget_stock_quoteget_max_painget_historical_vexget_historical_stock_quoteget_zero_dte_flowget_historical_gex

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×6

  declared capabilities: code/command execution

  get_liquidity

  declared capabilities: database access

  get_historical_vrpget_historical_coverage

  declared capabilities: filesystem access

  get_universe

  declared capabilities: HTTP requests

  get_option_quoteget_oi_diff

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.