ClawHub
Back to skill

Security audit

Journey

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Camino API wrapper for route planning, but users should treat waypoint and itinerary data as sensitive because it is sent to a third-party service.

Install only from a version or commit you trust, avoid submitting home/work/client or confidential itinerary details unless you accept Camino's data handling, and store CAMINO_API_KEY with the narrowest practical scope rather than sharing global agent settings broadly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-25
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

The installation documentation directs users to execute third-party package runners using the mutable latest tag and to install code from a GitHub repository without pinning a reviewed commit.

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill journey
bash
npx clawhub@latest install journey
# or: pnpm dlx clawhub@latest install journey
# or: bunx clawhub@latest install journey

Technical Analysis

The npx, pnpm dlx, and bunx commands download and execute packages from an external package registry. Using clawhub@latest permits the executed package version to change after this project has been reviewed. No cryptographic checksum, signature, or lockfile constrains the retrieved artifact.

Likewise, the GitHub installation commands reference the repository's mutable default branch rather than a specific reviewed commit SHA or immutable release. Consequently, the code installed by these commands can differ from the version considered during this audit.

This creates a supply-chain trust boundary in which compromise of the package publisher account, registry artifact, repository, or upstream maintainer can introduce arbitrary code into the installation process.

Attack Path

  1. An attacker compromises the relevant package publisher account, package registry artifact, GitHub repository, or upstream maintainer workflow.
  2. The attacker publishes a malicious version under the latest tag or modifies the repository's mutable default branch.
  3. A user follows the documented installation command.
  4. The package runner retrieves the attacker-controlled version or repository content.
  5. Installer logic, package lifecycle scrip ...[truncated 767 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specific, reviewed package version, for example:

    bash
    npx clawhub@<reviewed-version> install journey

  2. Pin GitHub installations to a full reviewed commit SHA rather than the mutable default branch:

    bash
    npx skills add https://github.com/barneyjm/camino-skills.git#<full-commit-sha> --skill journey

  3. Publish and verify cryptographic checksums or signed provenance for downloaded releases and installer artifacts.

  4. Use lockfiles and integrity metadata where the package manager supports them.

  5. Review package lifecycle scripts and disable unnecessary lifecycle execution during installation when supported.

  6. Document the exact trusted package version, repository commit, expected checksum, and verification procedure.

  7. Run installation with a non-privileged account in an isolated environment, limiting access to secrets and sensitive files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to place an API key into ~/.claude/settings.json, which is a sensitive agent configuration location. While common for setup, directing edits to a global config path can expand blast radius if mishandled, expose secrets to other skills or sessions, or normalize modification of privileged agent configuration.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell-based usage and installation commands but does not declare any tool scope or allowed-tools boundary. In an agent environment, this can lead to over-broad shell access being implicitly available, increasing the chance that a model executes commands beyond the minimum needed for the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or commit allows whatever code is currently served by that package/repository to be fetched at install time. This creates a supply-chain risk where upstream compromise or repository changes could silently alter the installed skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill-specific install command still references an unpinned remote GitHub source, so the exact content installed can change over time. In a security-sensitive agent environment, that weakens trust and makes review non-repeatable.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

npx clawhub@latest install journey explicitly opts into the latest package version, which is mutable and may introduce unreviewed behavior. This is a classic supply-chain exposure because installation behavior can change without user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The documented trial flow sends a user email address to an external service to obtain an API key. This is expected product behavior, but it is still a real data transmission that carries privacy implications and should be disclosed clearly in a skill consumed by autonomous agents.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation encourages sending waypoint coordinates, purposes, transport preferences, and time constraints to an external API but does not clearly warn users that sensitive location and itinerary data leaves the local environment. For travel planning, this context materially raises privacy risk because precise movements and destinations can reveal home, work, habits, or meetings.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The core skill functionality sends waypoints and constraints to https://api.getcamino.ai/journey, which means user-provided location and itinerary data is transmitted off-box. In the context of journey planning, this is expected but still sensitive because it can expose movement patterns, meeting locations, and other personal data if users are not warned.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

], "constraints": {"transport": "foot"} }'
"https://api.getcamino.ai/journey"

text

## Parameters

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script transmits user-supplied waypoint data and the API credential to an external third-party service via curl. This creates a data exfiltration and trust-boundary risk because potentially sensitive itinerary, location, and scheduling information leaves the local environment and is processed remotely.

Content

Scanner excerpt · scripts/journey.sh (reported line 46)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded external endpoint confirms that the skill always sends data to a remote service outside the local execution boundary. In the context of a journey planner, this is functionally expected, but it is still security-relevant because travel routes and waypoints can be highly sensitive and the transfer is mandatory for operation.

Content

Scanner excerpt · scripts/journey.sh (reported line 51)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/journey" | jq .

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes a journey-planning skill focused on route optimization, feasibility, and time constraints, but does not mention authentication or secret access. While network access to a routing backend may be an expected implementation detail, explicitly requiring and reading a credential from the environment is an additional capability not described in the stated purpose.

Content

No source excerpt is available for this finding.