School Finder
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's requests and runtime behavior line up with its stated purpose (calling Camino AI with CAMINO_API_KEY); only minor bookkeeping mismatches and typical install cautions were found.
This skill appears to do what it says: it queries Camino's API for nearby schools and needs your CAMINO_API_KEY. Before installing: 1) Verify the upstream source (the SKILL.md points to a GitHub repo) to ensure you trust the publisher. 2) Ensure jq and curl are installed (the script checks for them) — the manifest did not declare these, so you may see an install-time error. 3) Prefer using a trial or limited-scope API key first, and avoid placing long-lived secrets in world-readable files; if you must persist the key, store it in a secure secrets mechanism rather than plain text. 4) Inspect the referenced GitHub repo (or the included script) for unexpected network endpoints — the script here only calls api.getcamino.ai, which matches the documentation. If you want stronger assurance, ask the publisher for a signed release or a vetted package instead of installing directly from an arbitrary repo.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.