Security audit

fleece

Security checks across malware telemetry and agentic risk

Overview

The core CLI is mostly coherent, but the published artifact also contains broader iOS, wallet, location, Gmail, and safety-filter-bypass behavior that users should review before installing or building.

Install the CLI only if you are comfortable storing card/profile data locally in fleece.db and sending relevant query context to Brave Search. Avoid broad multi-agent installs unless you want the extra agent instructions, especially the Gmail spend skill. Do not build or run the iOS app without reviewing its location, notification, Apple Wallet, and silent profile-saving behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (81)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation instructs users to provide a Brave API key via environment variables, reads and writes a local SQLite database, and performs live network lookups, but the skill declares no permissions. That creates a transparency and consent problem: users and hosting platforms cannot accurately assess that the skill accesses local data, secrets, and external services before installation or use.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The static analysis indicates the package behavior extends well beyond the declared CLI research purpose, including a Streamlit chatbot, local persistence/migration logic, remote image fetching, installer scripts for multiple agent ecosystems, and build automation. This mismatch is dangerous because users may grant trust based on the narrow description while the package exposes a much larger attack surface, including additional networked components and persistence behaviors not disclosed in the skill file.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The app requests both notification and location permissions immediately on launch, but this file shows no clear feature gating or user-visible justification before doing so. Given the stated purpose is primarily credit-card research/redemption, collecting location and enabling notifications broadens data access beyond user expectations and creates unnecessary privacy risk if these capabilities are not strictly required.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The code explicitly rewrites user prompts to avoid Apple's safety classifier while preserving the original intent shown in the UI. That is a safety-bypass pattern: it undermines platform protections and can enable disallowed or riskier requests to be processed after semantic laundering.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The session instructions assert that all queries are legitimate finance topics, which can bias the model toward treating risky inputs as pre-approved. In combination with existing safety-trigger handling, this creates a contradictory design that weakens trust in safety boundaries and may encourage the model to disregard risk signals.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: This code probes Apple Wallet payment-network availability via PassKit, which reveals device wallet state that is not disclosed by the skill's CLI-oriented description. Even though it only infers broad card networks rather than exact card identities, it still accesses sensitive device/payment-related context and can be used to profile the user beyond the stated functionality.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The service enumerates payment networks and uses them to suggest cards, which is a form of device-side wallet/payment probing not obviously required for a credit-card research CLI. In this context, the mismatch between declared purpose and implemented capability makes the behavior more suspicious because it gathers sensitive financial signals that users would not reasonably expect from the described tool.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The UI explicitly tells users the advisor is 'private, on-device,' but this view forwards prompts to a ChatService without any evidence in this file that processing is strictly local. If ChatService sends prompts or wallet-related context to a remote backend, users may disclose sensitive financial information under a false privacy assumption, making this a deceptive privacy/security issue.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This view implements an iOS map interface with live location tracking, manual map pinning, and nearby-place search behavior that is materially unrelated to the declared skill purpose of a credit-card research/redemption CLI. That mismatch is dangerous because it expands the app into collecting and acting on sensitive location data under a misleading manifest, which can hide surveillance or undisclosed profiling functionality from users and reviewers.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code reacts to precise device GPS updates by recentering the map and using coordinates to drive nearby-place discovery, despite no clear justification from the declared credit-card CLI functionality. Precise location is sensitive personal data, and collecting or using it without clear necessity and transparent disclosure increases the risk of covert tracking, behavioral profiling, or user deception.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The design explicitly states that the app extracts spending amounts from free-form chat and persists them automatically, which is broader than a user would reasonably expect from a recommendations/chat interaction unless clearly disclosed. Because the data is financial-behavior information and is reused across future sessions, this creates a meaningful privacy and informed-consent issue even if storage is only local.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The backlog proposes automatically and silently saving spending-profile amounts mentioned in chat, then reusing that data in future sessions. This exceeds what users would reasonably expect from a conversational recommendation flow and creates a hidden profiling mechanism that can capture financial-behavior data without explicit consent or review.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The project explicitly requests both foreground and background location access for 'nearby stores' and 'as you move between stores,' which exceeds what is typically necessary for a credit-card research/rewards app. In this skill context, continuous location tracking can reveal sensitive movement patterns and shopping behavior, creating privacy risk if collected, retained, or shared.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The instruction to use the CLI whenever the user asks about broadly defined credit-card-related topics creates an overbroad trigger surface. This can cause the agent to invoke an external tool for routine informational queries without sufficiently verifying necessity, user intent, or data-sensitivity boundaries, increasing the chance of unnecessary external lookups and overcollection.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase about finding business class flights maps a natural-language travel request directly to a command that opens results, with no stated constraints or confirmation step. Broad triggers like this can cause automatic tool use for common travel-planning queries and may launch browser-based actions unexpectedly.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The phrase about spending profile is broad because many ordinary budgeting or spending-advice questions could match it, yet the associated command accesses profile data. In this skill's context, that creates risk of pulling potentially sensitive locally stored financial-profile information without a clear, explicit request.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation states that `fleece wallet` auto-loads saved cards from `fleece.db` with no arguments, but it does not warn that invoking the command may access previously stored sensitive financial data. In an agent setting, silent automatic access to local wallet contents is especially dangerous because a broad or mistaken trigger could expose card portfolio details without informed user consent.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The README instructs users to save spending and travel-profile fields such as monthly spend, home airport, goals, and annual fee tolerance, but does not clearly disclose that this personal financial and preference data will be stored locally or describe where and how it is stored. This can lead users or downstream agent workflows to persist sensitive personal data on shared machines or in synced config directories without informed consent, increasing privacy exposure.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill explicitly encourages storing a spending profile in a local database, including monthly spending, annual-fee tolerance, home airport, travel goals, and preferred loyalty programs, but it does not warn users about local persistence of sensitive financial preference data. While not necessarily secret like a password, this data is privacy-sensitive and could be exposed to other local users, backups, malware, or unintended support/debug workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code explicitly formats sensitive user profile data and owned-card information into a natural-language context string intended for injection into external search queries or LLM prompts. That creates a real privacy and data-minimization risk because spending habits, home airport, travel goals, preferences, and current cards may be transmitted to third-party services without any consent, redaction, or scope limitation visible in this module.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The documented merchant and recommendation phrases are intentionally broadened to match natural user language, which can cause a hosting agent to invoke the skill on ordinary shopping or merchant questions without clear user intent to use a credit-card analysis tool. In a multi-skill environment, this can lead to unintended routing, profile use, or overcollection of financial-preference context.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Profile-related trigger phrases such as remembering spending habits resemble normal conversation and may prompt unintended activation or silent persistence of personal financial-preference data. In context, the skill explicitly discusses auto-injecting profile context into later commands, which raises the privacy and consent risk if activation is too loose.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The page prominently advertises continuous location-triggered behavior and pre-payment notifications, but it does not present a clear user-facing warning about the sensitivity of always-on location access and notification frequency. For a finance-related app, this can mislead users about privacy and behavioral implications before they install or enable the feature.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Describing Apple Wallet detection as 'silent' and pairing it with automatic business-entry notifications without an explicit explanation of what wallet-related data is accessed can create deceptive privacy expectations. Even if processing is on-device, users should be clearly informed that wallet/network presence and notification behavior are used to personalize recommendations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The Debug expander can display the full conversation memory store and buffer directly in the UI, which may include sensitive user financial details, profile data, wallet contents, and prior prompts. In a credit-card advisory app, exposing retained memory without access controls, redaction, or a clear warning increases the risk of inadvertent disclosure to anyone viewing the session or shared screen.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: ios/ios-known-issues.md:104