ClawHub
Back to skill

Security audit

Real Estate

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends user-provided real-estate locations to Camino AI for neighborhood analysis, with some privacy and supply-chain cautions.

Install only if you are comfortable with Camino receiving the addresses or precise coordinates you evaluate, plus your email if you use the trial signup. Store the API key carefully, prefer a scoped environment variable or secret store over a broad agent settings file when possible, and use pinned install references if you need reproducible installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installation Chain

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The instructions tell users to place an API key into ~/.claude/settings.json, which is a sensitive agent configuration location. Modifying agent config directories increases risk because secrets may be broadly exposed to the agent runtime, inherited by other skills, or accidentally committed or disclosed through tooling.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill documents shell-based execution paths but does not declare any explicit tool scope such as allowed-tools or permissions. That increases the chance an agent can invoke shell actions more broadly than users expect, reducing containment and making misuse or accidental command execution more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx skills add without a pinned version makes installation dependent on whatever package version is current at execution time. This creates a supply-chain risk where a compromised or breaking upstream release could change behavior or introduce malicious code during install.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The second npx skills add example also uses an unpinned package invocation. Reproducibility and trust are weakened because future installs may fetch different code than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

npx clawhub@latest explicitly tracks the latest release, which is inherently non-deterministic and raises supply-chain exposure. If the upstream package is compromised or publishes a faulty release, users may execute unreviewed code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill processes addresses and coordinates by sending them to Camino's external API, but the description does not clearly warn users that location data leaves the local environment. Since home and rental searches often involve sensitive residential locations, this omission can mislead users about privacy exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The trial signup example sends a user email address to an external service. This is an external data transmission involving personal information, and without a prominent privacy notice it can expose users to unexpected disclosure or tracking.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The geocoding request sends a user-supplied address and API key to an external API. For a real-estate skill, addresses may correspond to homes, prospective residences, or other sensitive locations, so transmission to a third party has meaningful privacy implications.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash
# Step 1: Geocode the address
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/query?query=742+Evergreen+Terrace+Springfield&limit=1"

# Step 2: Get context with real estate focus
curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The context request transmits precise coordinates, search radius, and real-estate-related context to an external service. Precise location combined with housing-interest context can reveal sensitive behavioral or residential information if mishandled or retained.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"location": {"lat": 40.7589, "lon": -73.9851}, "radius": 1000, "context": "real estate evaluation: schools, transit, grocery, parks, restaurants, walkability"}'
"https://api.getcamino.ai/context"

text

## Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits a user-supplied street address to a third-party geocoding API without any explicit user-facing notice or consent step. Addresses and coordinates are sensitive location data, and in a real-estate evaluation skill this behavior is expected for functionality but still creates a privacy exposure because users may not realize their exact location is being sent off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The GET request sends the user-provided address to an external Camino endpoint for geocoding. A home or rental address is highly sensitive in this skill context, so transmitting it to a third party without visible warning increases privacy risk even if there is no obvious code injection or command execution issue.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 54)May include surrounding context.

sh
GEOCODE_RESULT=$(curl -s -X GET \
        -H "X-API-Key: $CAMINO_API_KEY" \
        -H "X-Client: claude-code-skill" \
        "https://api.getcamino.ai/query?query=${encoded_query}&limit=1")

    # Extract lat/lon from first result
    LAT=$(echo "$GEOCODE_RESULT" | jq -r '.results[0].lat // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This POST request sends precise latitude/longitude and search radius derived from user input to an external service. Even though the transmission is core to the skill's purpose, it is still a true privacy/security concern because sensitive location information leaves the local environment and could be logged, retained, or correlated by the remote provider.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 86)May include surrounding context.

sh
}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This endpoint receives the built context payload containing the user's location and radius for neighborhood analysis. In the real-estate context, collecting nearby schools, parks, and walkability is legitimate, but the skill still exports sensitive location intelligence to an external API, which is a meaningful data exposure if users are not informed.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 91)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .