ClawHub
Back to skill

Security audit

Ev Charger

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent EV charger lookup integration, but users should understand it sends search and location data to Camino AI and uses mutable install commands.

Install only if you are comfortable using Camino AI as a third-party service for EV charger searches. Prefer a pinned install source when possible, store the API key with appropriate local permissions, and avoid sending precise home or sensitive trip locations unless you accept that those query details are transmitted to Camino AI.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Remote Dependencies and Mutable Installation Sources

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ev-charger.sh:34
Finding

Unvalidated URL Parameters Permit Curl URL Globbing and Query Manipulation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to place an API key into ~/.claude/settings.json, which is a sensitive agent configuration location. Modifying this directory can affect broader agent behavior and may expose secrets to other skills, logs, backups, or unintended tooling if access controls are weak.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill includes shell-based installation and execution instructions but does not declare any explicit tool scope or allowed-tools boundaries. In an agent setting, this can lead to over-broad shell access being assumed or granted, increasing the chance that the skill is run with more capability than necessary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without pinning a version, tag, or commit means the installed code can change over time. If the upstream package or referenced repo is compromised, users may fetch and execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Installing a specific skill from an unpinned GitHub source still leaves users exposed to supply-chain changes in the repository state. A later malicious or accidental change could alter the skill content or associated scripts without the user realizing it.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

npx clawhub@latest install ev-charger explicitly tracks the latest version, which is mutable and could introduce malicious or breaking changes at any time. This is a classic supply-chain risk because execution happens before the user can meaningfully review what changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup flow asks the user to transmit an email address to a third-party API endpoint to obtain a trial key, but it gives no privacy notice or data-handling explanation. This creates a privacy and compliance risk because users may disclose personally identifiable information without understanding retention, sharing, or consent implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This command sends user-provided email data to an external service endpoint. Even though this is part of normal product setup, it is still an external data transmission and should be treated as sensitive because it shares personal information outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits user-supplied query and location fields such as lat, lon, and radius to a third-party Camino API, but the script itself provides no user-facing notice that precise destination or route-adjacent location data will leave the local environment. In a skill context, this is a genuine privacy issue because location data can be sensitive, and users or calling agents may not realize the data is being disclosed externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The script makes an outbound request to https://api.getcamino.ai/query and includes user-derived parameters in the URL query string, along with an API key in a header. External transmission is expected for this skill's functionality, but it is still a true data exposure boundary because sensitive location/search data is sent to a remote service and may be logged by intermediaries or the provider.

Content

Scanner excerpt · scripts/ev-charger.sh (reported line 65)May include surrounding context.

sh
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .