ClawHub
Back to skill

Security audit

Parking Finder

Security checks for vulnerabilities and agentic risk

Overview

This parking skill coherently uses a Camino API key to send parking searches and coordinates to Camino's external service, with no hidden execution, persistence, or destructive behavior found.

Install only if you are comfortable sending parking searches, venue names, optional precise coordinates, and trial signup email to Camino. Prefer pinned install sources when available, and when configuring Claude Code add only CAMINO_API_KEY to settings rather than copying broader configuration changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-23
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill parking-finder
bash
npx clawhub@latest install parking-finder
# or: pnpm dlx clawhub@latest install parking-finder
# or: bunx clawhub@latest install parking-finder

Technical Analysis

The documented installation workflow invokes npm-distributed package runners and retrieves Skill content from mutable third-party sources. The clawhub@latest reference explicitly resolves to whichever release is current at installation time. Similarly, the GitHub repository URL is not pinned to an immutable commit hash.

As a result, the code or Skill content executed or installed by these commands can change after this audit without any modification to the reviewed project. Compromise of the relevant npm publisher account, package, GitHub account, repository, or default branch could introduce attacker-controlled content into the installation process.

No evidence indicates that the currently reviewed dependencies are malicious. The vulnerability is the absence of version pinning and integrity controls in commands that users are instructed to execute.

Attack Path

  1. An attacker compromises a referenced npm publisher account, package release process, GitHub account, or repository.
  2. The attacker publishes a malicious version under the tag resolved by @latest, or modifies the mutable GitHub repository content.
  3. A user follows the installation instructions in SKILL.md.
  4. npx, pnpm dlx, or bunx downloads and runs the dynamically resolved package, or the installer retrieves altered Skill content from the repository.
  5. Malicious pac ...[truncated 851 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version rather than a floating distribution tag.
  2. Pin GitHub installation sources to a specific immutable commit hash instead of the repository's mutable default branch.
  3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts.
  4. Document the exact package versions and source commits that were security-reviewed.
  5. Use lockfiles and package-manager integrity metadata where the installation workflow supports them.
  6. Review package lifecycle scripts and minimize or disable installation-time script execution when feasible.
  7. Update pinned versions only through a controlled process that includes source review, integrity verification, and security testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The instructions direct users to modify ~/.claude/settings.json, which is a sensitive agent configuration file. Encouraging direct edits to agent config increases the blast radius of mistakes or malicious copy-paste behavior, since that file can influence broader agent behavior and expose secrets if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell-based execution and installation commands but does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, that can lead to overbroad shell access assumptions and weaker enforcement of least privilege, increasing the chance that the skill is run with more capability than needed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx skills add without a pinned version makes installation non-reproducible and exposes users to supply-chain risk if the upstream package changes, is compromised, or resolves differently over time. Because this is an installation path for a skill repository, a malicious update could alter what gets installed or executed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This second npx skills add invocation also lacks version pinning, creating the same supply-chain exposure as the first example. Multiple unpinned install instructions increase the likelihood that users will follow an unsafe installation path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx clawhub@latest install parking-finder explicitly tracks the latest release, which is unsafe from a supply-chain perspective because future upstream changes can alter behavior at install time. If the package or dependency chain is compromised, users may execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples send user queries, venue names, and precise latitude/longitude coordinates to a third-party API, but the documentation does not clearly warn about that data disclosure. In a location-focused skill, this omission is especially important because location data can be sensitive and may reveal habits, destinations, or identity-linked movement patterns.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The trial setup command sends an email address to an external service to obtain an API key. This is an external transmission of user data and should be treated as sensitive because it shares personally identifiable information with a third party.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The documented query example sends search terms and precise coordinates to Camino's external API. In the context of a parking finder, this is expected functionality, but it still creates privacy risk because destinations and exact location can be highly sensitive.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/query?query=parking+garages+lots&lat=40.7505&lon=-73.9934&radius=1000&rank=true"

Parameters

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parking-finder.sh (reported line 65)May include surrounding context.

sh
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .