T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Third-Party Installation Commands Permit Supply-Chain Code Substitution
- Content
View full analysis
- Remediation
View remediation
Security audit
Query
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Camino place-search helper with expected external API use, but users should treat location queries and the API key as sensitive.
Install from a reviewed or pinned source where possible. Use a revocable Camino API key, protect the local settings file that stores it, and avoid sending home, work, travel, or other sensitive location queries unless you are comfortable sharing them with Camino's API.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:43- Finding
API Key Is Persisted in Plaintext User Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Add your key to Claude Code:
Add to your
~/.claude/settings.json:json {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents shell-based installation and execution paths but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, missing scope increases the chance the skill can invoke shell actions more broadly than users expect, reducing containment and reviewability.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The installation command uses
npx skillsfrom a remote source without pinning an exact version or commit. This creates a supply-chain risk because future upstream changes or a compromised package could cause users to install or execute unintended code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This command again relies on an unpinned
npx skillsinvocation to fetch and install code, which exposes users to supply-chain drift and possible malicious upstream changes. In agent tooling contexts, install-time code execution is especially sensitive.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Using
npx clawhub@latestexplicitly tracks the latest release, which is non-deterministic and increases exposure to malicious or breaking updates. If the package is compromised, users may execute attacker-controlled code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages sending natural-language queries, coordinates, and possibly sensitive place preferences to a third-party API but does not warn users about privacy implications or data handling. Location queries can reveal home, work, travel patterns, or other sensitive context, making silent transmission riskier in this skill than in many generic API integrations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill instructs users to transmit an email address to an external service to obtain a trial API key. While this is expected product behavior, it is still an external data transmission that can expose personal information without any accompanying privacy disclosure or consent guidance.
- Content
Instant Trial (no signup required): Get a temporary API key with 25 calls:
bash curl -s -X POST -H "Content-Type: application/json" \ -d '{"email": "you@example.com"}' \ https://api.getcamino.ai/trial/start
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The example sends user search terms and potentially sensitive location intent to an external API, authenticated with an API key, without warning about third-party processing. In a location-intelligence skill, these requests may reveal highly sensitive behavioral or geographic information, so the context makes the transmission meaningfully more dangerous.
- Content
bash curl -H "X-API-Key: $CAMINO_API_KEY" \ "https://api.getcamino.ai/query?query=coffee+shops+near+Times+Square&limit=5"Parameters
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .