Options Spread Conviction Engine

Multi-regime options spread analysis engine with Kelly Criterion Position Sizing. Scores vertical spreads (bull put, bear call, bull call, bear put) and mult...

This package appears to implement the options-analysis functionality it claims, but there are packaging and install inconsistencies that increase risk. Before installing or running it: - Inspect scripts/setup-venv.sh and any install scripts in the repo line-by-line; do not run them until you verify they only create a virtualenv and pip-install known packages. - Ignore or do not run the 'sudo ln -s /usr/local/bin/...' step unless you understand why a system-wide CLI is needed; avoid running sudo for third-party code unless absolutely necessary. - The README suggests installing an npm package (yahoo-finance2) — confirm whether the Python code actually needs that JS package; if not, skip it. - Because the repo has documented 'bare except' patterns and duplicated critical logic (Kelly implementations), consider running the test suite (tests/run_tests.py) in an isolated environment (container or VM) to verify behavior before trusting outputs for live trading. - Prefer running the engine in an isolated environment (VM, container) with limited network and no access to production trading accounts. If you plan to connect to a broker/API later, supply credentials only at that stage and after code audit. If you want, I can: - Summarize the contents of scripts/setup-venv.sh (if you provide it) and flag any dangerous commands; or - Highlight exact files/lines where bare excepts or subprocess/shell invocations occur so you can inspect them more easily.

Type: OpenClaw Skill Name: options-spread-conviction-engine Version: 2.2.1 The skill is classified as suspicious due to several high-risk behaviors and documented vulnerabilities. The `SKILL.md` instructs the AI agent to execute `sudo ln -s /opt/homebrew/bin/yahoo-finance /usr/local/bin/yf`, which attempts privilege escalation by requiring `sudo` access to create a symlink in a system-wide executable path. Additionally, `scripts/chain_analyzer.py` uses `pickle.dump` and `pickle.load` for caching, which is a known deserialization vulnerability if an attacker can inject malicious data into the cache directory. The internal `CODE_REVIEW_REPORT.md` further highlights critical vulnerabilities such as 'Inconsistent Error Handling', 'Bare Except Clauses', and 'Missing Input Validation' across the codebase, which could lead to unpredictable behavior or be exploited for remote code execution.