Security audit
Security checks for vulnerabilities and agentic risk
This local miles calculator has limited access, but overstates its features and can give poor expiry recommendations.
Use it as a calculator and independently verify current fares and reward terms. Do not rely on expiry-based BURN recommendations: they can favor an option worse than cashing out or paying cash. Saved comparison details remain in a local plaintext file until cleared.
The core CPP calculations, ranking, and verdicts match the declared purpose. However, the advertised sweet-spot checking and cash-fare-floor pricing are not implemented. Local JSON persistence and clearing saved options are supporting implementation details, not unrelated capabilities. No network access, booking, point transfers, or other unrelated behavior appears in the supplied code.
Without declared permissions the skill's intent is opaque and cannot be validated.
The expiration override recommends BURN for transferable points worth at least 0.5 cents each even when their configured cash-out alternative is 1 cent each. Under the script's own assumptions, cashing out before expiration preserves more value, so this logic can induce avoidable financial loss and directly undermines the skill's stated purpose; impact is limited because the script only recommends actions and does not execute redemptions.
The manifest promises to check redemption options against 12 known partner sweet spots, but L042–L058 define only seven patterns and L168–L173 merely print them. Evaluation at L113–L120 uses fare arithmetic and currency thresholds without consulting these patterns, so the advertised partner comparison does not inform recommendations.
