Relationship
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is internally consistent with its stated purpose (calling Camino's relationship API) and only requests a single API key; no evidence of exfiltration or unrelated privileges was found.
This skill appears to do exactly what it says: send two coordinates to Camino's relationship API and return distance/direction/travel time. Before installing or running: (1) Inspect the GitHub repo referenced by the SKILL.md (npx will fetch remote code) to ensure you trust its owner; (2) ensure jq and curl are installed (the script fails without them) — the registry metadata omits these required binaries; (3) protect your CAMINO_API_KEY (adding it to ~/.claude/settings.json stores a secret on disk—check file permissions); and (4) verify the api.getcamino.ai endpoints are what you expect before sending sensitive location data.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.