ClawHub
Back to skill

Security audit

Context

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward location-context skill that sends user-provided coordinates to Camino's API, with privacy and supply-chain cautions but no hidden or destructive behavior found.

Install only if you are comfortable sending location coordinates, optional context text, and your API key to Camino's service. Prefer a pinned or reviewed install source where possible, and store the API key carefully if you add it to Claude Code settings.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Installation Sources Enable Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–23
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill context

Via clawhub:

bash
npx clawhub@latest install context

Technical Analysis

The installation instructions execute dynamically obtained npm tooling and install Skill content from a GitHub repository without pinning an immutable package version, commit hash, or integrity digest. The explicit @latest tag is mutable, while the GitHub repository URL resolves according to upstream repository state rather than a reviewed commit.

Consequently, the code ultimately downloaded and executed can change after this project has been audited. If the npm packages, publisher accounts, GitHub repository, or associated release process are compromised, an attacker could substitute malicious installer behavior or Skill content. Package runners such as npx execute downloaded package code under the invoking user's account, so a malicious release could perform actions beyond merely copying the Skill.

Attack Path

  1. An attacker compromises the publisher account, npm package, GitHub repository, or upstream release workflow referenced by the installation commands.
  2. The attacker publishes a malicious version under the mutable latest tag or modifies the repository branch resolved by the unpinned GitHub URL.
  3. A user follows the documented installation instructions.
  4. npx, pnpm dlx, or bunx retrieves and executes the mutable package, or the installer retrieves modified repository content.
  5. Malicious installer code executes with the permissions of the invoking user or installs altered Skill instructions and scripts.
  6. The payloa ...[truncated 855 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a reviewed, exact package version. Do not use mutable version ranges or distribution tags in security-sensitive installation instructions.
  2. Pin the GitHub source to a specific reviewed commit SHA rather than the repository's default branch.
  3. Record and verify cryptographic integrity information for downloaded artifacts, such as npm lockfile integrity values, release checksums, or verified signatures.
  4. Prefer a trusted package manager workflow with a committed lockfile over ad hoc runtime package execution.
  5. Verify package publisher identity, repository ownership, release provenance, and package signatures before installation.
  6. Execute installation in a least-privileged, isolated environment without unrelated credentials or sensitive environment variables.
  7. Add automated dependency monitoring and require security review before updating pinned versions or commit references.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The instructions direct users to place an API key into '~/.claude/settings.json', an agent configuration directory that may contain other sensitive settings and can affect broader agent behavior. Encouraging manual modification of this high-value config path increases the blast radius of mistakes, accidental disclosure, or unsafe automation interacting with that file.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation demonstrates shell-based installation and execution but does not declare any explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, this can lead to overbroad execution capability, making it easier for a consuming agent to invoke shell commands without clear user-visible constraints.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using 'npx skills add' without pinning a specific version makes installation depend on whatever package version is current at execution time. This creates a supply-chain risk where a compromised or unexpectedly changed upstream package could execute different code than the reviewed skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install command references 'npx skills add' again without a pinned version, so users may fetch and run unreviewed package updates. In a shell-driven install flow, this increases the risk of supply-chain compromise during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The documentation uses 'npx clawhub@latest install context', which explicitly tracks the latest release. Installing unpinned tooling from npm can expose users to malicious or breaking upstream changes that were not part of the reviewed skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill centers on sending user-provided coordinates, context, and optionally weather-related queries to a third-party API, but the documentation does not clearly warn users that their location data will leave the local environment. Because precise location is sensitive personal data, omission of this disclosure increases privacy and consent risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The documented trial signup sends a user email address to an external service, which is a data transmission to a third party. While expected for provisioning an API key, it is still a privacy-relevant operation and should be clearly disclosed because users may not realize personal data is being transmitted during setup.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The core skill operation sends location coordinates and user context to 'https://api.getcamino.ai/context', which is an external transmission of potentially sensitive location data. In the context of a location-intelligence skill this behavior is expected, but it is still dangerous if users are not clearly informed because precise coordinates can reveal home, work, or travel patterns.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"location": {"lat": 40.7589, "lon": -73.9851}, "radius": 500, "context": "lunch options"}'
"https://api.getcamino.ai/context"

text

## Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script transmits precise user-supplied location data to a third-party remote API, but it does not provide any explicit notice, consent prompt, or privacy warning at the point of use. Because location data is sensitive, silent transmission can expose users to privacy harm or policy/compliance violations if they do not realize their coordinates are being sent off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This curl invocation sends raw user-controlled input in the request body to an external service along with an API credential in a header. Even though the destination is fixed and HTTPS is used, external transmission of sensitive location data is still a real security/privacy issue when not clearly disclosed or constrained.

Content

Scanner excerpt · scripts/context.sh (reported line 46)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The hardcoded remote endpoint confirms that the skill is designed to exfiltrate user-provided location context to an external domain. In a location-analysis skill this is expected behavior, but it remains security-relevant because the transmitted data may be sensitive and users may not understand that the operation is not local.

Content

Scanner excerpt · scripts/context.sh (reported line 51)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/context" | jq .