Real Estate

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:18 AM UTC
• Version: 2.0.0

Overview

This skill does what it says: it sends user-provided real-estate locations to Camino AI for neighborhood analysis, with some privacy and supply-chain cautions.

Install only if you are comfortable with Camino receiving the addresses or precise coordinates you evaluate, plus your email if you use the trial signup. Store the API key carefully, prefer a scoped environment variable or secret store over a broad agent settings file when possible, and use pinned install references if you need reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Third-Party Installation Chain<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-23 **Vulnerability Type**: Unpinned package and repository dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill real-estate ``` ```bash npx clawhub@latest install real-estate # or: pnpm dlx clawhub@latest install real-estate # or: bunx clawhub@latest install real-estate ``` ### Technical Analysis The documented installation commands retrieve and execute third-party components without pinning them to immutable, audited versions. The GitHub installation commands reference a mutable repository state rather than a specific commit hash or signed release. The package-runner commands explicitly use `clawhub@latest`, causing the executed installer to depend on whichever release the registry identifies as latest at installation time. Consequently, the code executed by future users can differ from the code that was available during this audit. Compromise of an upstream maintainer account, package registry, publishing token, or repository could turn these otherwise legitimate installation commands into a supply-chain delivery mechanism. The vulnerable commands are installation instructions and are not automatically executed by `scripts/real-estate.sh`. Exploitation therefore requires a user or automation system to follow the documented installation procedure. ### Attack Path 1. An attacker compromises the upstream GitHub repository, package publisher account, registry artifact, or related release infrastructure. 2. The attacker adds malicious installation or package code to the mutable repository branch or publishes it as the package version selected by `@latest`. 3. A user follows one of the installation commands in `SKILL.md`. 4. `npx`, `pnpm dlx`, `bunx`, or the skills installer downloads the ...[truncated 857 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact package version, for example `clawhub@x.y.z`. 2. Pin the GitHub source to a specific immutable commit hash rather than relying on the repository's default branch. 3. Where supported, require package integrity hashes, signed releases, or provenance verification. 4. Maintain and publish lockfiles for installation workflows that support them. 5. Review package lifecycle scripts before allowing package runners to execute them. 6. Document the expected source repository, version, commit hash, and integrity value so users can verify downloaded artifacts. 7. Update pinned versions only after reviewing the new release and its transitive dependencies. 8. Advise users not to run installation commands with administrative or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

**Add your key to Claude Code:**

Add to your `~/.claude/settings.json`:

```json
{

• Confidence: 90% confidence
• Finding: The instructions tell users to place an API key into `~/.claude/settings.json`, which is a sensitive agent configuration location. Modifying agent config directories increases risk because secrets may be broadly exposed to the agent runtime, inherited by other skills, or accidentally committed or disclosed through tooling.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documents shell-based execution paths but does not declare any explicit tool scope such as allowed-tools or permissions. That increases the chance an agent can invoke shell actions more broadly than users expect, reducing containment and making misuse or accidental command execution more likely.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx skills add` without a pinned version makes installation dependent on whatever package version is current at execution time. This creates a supply-chain risk where a compromised or breaking upstream release could change behavior or introduce malicious code during install.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The second `npx skills add` example also uses an unpinned package invocation. Reproducibility and trust are weakened because future installs may fetch different code than what was originally reviewed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: `npx clawhub@latest` explicitly tracks the latest release, which is inherently non-deterministic and raises supply-chain exposure. If the upstream package is compromised or publishes a faulty release, users may execute unreviewed code immediately.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill processes addresses and coordinates by sending them to Camino's external API, but the description does not clearly warn users that location data leaves the local environment. Since home and rental searches often involve sensitive residential locations, this omission can mislead users about privacy exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Instant Trial (no signup required):** Get a temporary API key with 25 calls:

```bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]"}' \
  https://api.getcamino.ai/trial/start
```

• Confidence: 90% confidence
• Finding: The trial signup example sends a user email address to an external service. This is an external data transmission involving personal information, and without a prominent privacy notice it can expose users to unexpected disclosure or tracking.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]"}' \
  https://api.getcamino.ai/trial/start
```

Returns: `{"api_key": "camino-xxx...", "calls_remaining": 25, ...}`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Geocode the address
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/query?query=742+Evergreen+Terrace+Springfield&limit=1"

# Step 2: Get context with real estate focus
curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \

• Confidence: 92% confidence
• Finding: The geocoding request sends a user-supplied address and API key to an external API. For a real-estate skill, addresses may correspond to homes, prospective residences, or other sensitive locations, so transmission to a third party has meaningful privacy implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"location": {"lat": 40.7589, "lon": -73.9851}, "radius": 1000, "context": "real estate evaluation: schools, transit, grocery, parks, restaurants, walkability"}' \
  "https://api.getcamino.ai/context"
```

## Parameters

• Confidence: 92% confidence
• Finding: The context request transmits precise coordinates, search radius, and real-estate-related context to an external service. Precise location combined with housing-interest context can reveal sensitive behavioral or residential information if mishandled or retained.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits a user-supplied street address to a third-party geocoding API without any explicit user-facing notice or consent step. Addresses and coordinates are sensitive location data, and in a real-estate evaluation skill this behavior is expected for functionality but still creates a privacy exposure because users may not realize their exact location is being sent off-platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

GEOCODE_RESULT=$(curl -s -X GET \
        -H "X-API-Key: $CAMINO_API_KEY" \
        -H "X-Client: claude-code-skill" \
        "https://api.getcamino.ai/query?query=${encoded_query}&limit=1")

    # Extract lat/lon from first result
    LAT=$(echo "$GEOCODE_RESULT" | jq -r '.results[0].lat // empty')

• Confidence: 95% confidence
• Finding: The GET request sends the user-provided address to an external Camino endpoint for geocoding. A home or rental address is highly sensitive in this skill context, so transmitting it to a third party without visible warning increases privacy risk even if there is no obvious code injection or command execution issue.

External Transmission

Medium

• Category: Data Exfiltration

Content

}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

• Confidence: 94% confidence
• Finding: This POST request sends precise latitude/longitude and search radius derived from user input to an external service. Even though the transmission is core to the skill's purpose, it is still a true privacy/security concern because sensitive location information leaves the local environment and could be logged, retained, or correlated by the remote provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .

• Confidence: 93% confidence
• Finding: This endpoint receives the built context payload containing the user's location and radius for neighborhood analysis. In the real-estate context, collecting nearby schools, parks, and walkability is legitimate, but the skill still exports sensitive location intelligence to an external API, which is a meaningful data exposure if users are not informed.