Firefly III

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:25 PM UTC
• Version: 1.0.0

Overview

This Firefly III skill is coherent, but it handles and can change sensitive financial data while giving under-scoped credential and mutation guidance.

Review this carefully before installing. Use it only with a Firefly III server you control and an HTTPS FIREFLY_URL, prefer a secure secret store or tightly protected environment variable over ~/.firefly_token, restrict and rotate the token where possible, and require clear confirmation before any create or update operation on accounts, transactions, budgets, rules, or other financial records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Plaintext Storage of a Financial API Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–26
Vulnerability Type: Plaintext credential storage and inconsistent secret handling
Risk Level: Medium

Vulnerable Code

markdown

Required environment:
- `FIREFLY_URL`: Base URL (e.g., `https://budget.example.com`)
- `FIREFLY_TOKEN`: Personal Access Token (stored at `~/.firefly_token`)

Get token: Profile → OAuth → Personal Access Tokens → Create new token

## API Basics

```bash
TOKEN=$(cat ~/.firefly_token)
BASE="$FIREFLY_URL/api/v1"
curl -s "$BASE/endpoint" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json"

text

### Technical Analysis

The skill directs users to store a Firefly III personal access token in the plaintext file `~/.firefly_token` and subsequently loads it into a shell variable. It does not require restrictive file permissions, verify ownership, or reject files readable by other users.

If the file is created under a permissive `umask`, other local users may be able to read it. Processes running under the same account can also retrieve the credential from the file. The token is a bearer credential, so possession is generally sufficient to authenticate without an additional secret.

The instructions are also inconsistent: they describe `FIREFLY_TOKEN` as a required environment variable but read the credential from `~/.firefly_token` instead. This ambiguity can encourage unnecessary duplication of the secret across environment configuration and local files.

The URL example uses HTTPS, but the instructions do not enforce an HTTPS scheme for `FIREFLY_URL`. If a user configures an unencrypted HTTP endpoint across an untrusted network, the bearer token may be exposed in transit.

### Attack Path

1. A user follows the skill instructions and stores a valid personal access token in `~/.firefly_token`.
2. The file is created with permissions that allow an un
...[truncated 1374 chars]

Remediation

View remediation

Remediation Suggestions

1. Use one clearly defined secret source. Prefer a secret manager, OS credential store, or securely injected FIREFLY_TOKEN environment variable instead of a persistent plaintext file.

2. If file-based storage must be supported, document secure creation and permissions:

   bash

   umask 077
   printf '%s' "$FIREFLY_TOKEN" > ~/.firefly_token
   chmod 600 ~/.firefly_token
   

3. Before reading the file, verify that it is owned by the current user, is a regular file rather than a symbolic link, and is not accessible by group or other users.

4. Require FIREFLY_URL to use HTTPS, except for explicitly documented loopback-only development deployments.

5. Avoid printing the token, including it in command traces, or passing it through command-line arguments that may be exposed through process listings.

6. Recommend a narrowly scoped token where Firefly III supports granular authorization.

7. Document token rotation and immediate revocation procedures for suspected exposure.

8. Update the configuration section so that it does not simultaneously describe FIREFLY_TOKEN as an environment variable and direct users to an unrelated plaintext token file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Required environment:
- `FIREFLY_URL`: Base URL (e.g., `https://budget.example.com`)
- `FIREFLY_TOKEN`: Personal Access Token (stored at `~/.firefly_token`)

Get token: Profile → OAuth → Personal Access Tokens → Create new token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- `FIREFLY_URL`: Base URL (e.g., `https://budget.example.com`)
- `FIREFLY_TOKEN`: Personal Access Token (stored at `~/.firefly_token`)

Get token: Profile → OAuth → Personal Access Tokens → Create new token

## API Basics

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation text is broad enough to trigger on many generic financial requests, increasing the chance the skill is invoked when the user did not intend to send sensitive financial data to an external Firefly III instance. In a finance skill, overbroad routing is more dangerous because it can cause unnecessary exposure of account, transaction, and budgeting information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not warn users that highly sensitive financial data may be transmitted to a self-hosted API endpoint. In this context, missing disclosure matters because users may reveal account names, balances, merchants, and transaction details without realizing the data leaves the local conversation context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill suggests creating a personal access token and reading it from a persistent file in the user's home directory, encouraging long-lived session material outside a dedicated secret store. In a finance integration, persistent bearer tokens are especially sensitive because compromise can enable full read/write access to transactions, budgets, and accounts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- `FIREFLY_URL`: Base URL (e.g., `https://budget.example.com`)
- `FIREFLY_TOKEN`: Personal Access Token (stored at `~/.firefly_token`)

Get token: Profile → OAuth → Personal Access Tokens → Create new token

## API Basics

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

# List accounts
curl "$BASE/accounts?type=asset" # asset|expense|revenue|liability
# Create account
curl -X POST "$BASE/accounts" -d '{
  "name": "Bank Account",
  "type": "asset",
  "account_role": "defaultAsset",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes budgets, transactions, accounts, categories, piggy banks, subscriptions, recurring transactions, and financial reports, but it does not mention rule management or auto-categorization automation. The documented API usage adds creation and listing of /rules, expanding the skill beyond the stated finance-management scope into workflow automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest enumerates supported areas such as transactions, accounts, budgets, categories, piggy banks, subscriptions, recurring transactions, and reports, but does not mention tags. Adding tag creation and listing broadens the documented behavior beyond what users would expect from the stated description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.