tradingview-indicators

CRITICAL: The `analyze_indicator` and `extract_functions` tools are vulnerable to path traversal. The `indicatorName` argument is directly used in `readIndicatorFile` without validation against a whitelist of allowed files or sanitization (e.g., preventing `../` sequences). This allows an attacker to read arbitrary files from the server's working directory or parent directories (e.g., `../../package.json`, `../../Dockerfile`, or potentially other sensitive configuration files on the host system if Docker volume mounting isn't perfectly restrictive). Although the Docker volume is mounted as read-only, this still poses a significant information disclosure risk. Network risks are low due to stdio transport, and no obvious hardcoded secrets or 'eval' are present.