ClawHub
Back to skill

Security audit

Relationship

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Camino API helper for comparing two locations, with the main caution that the coordinates you provide are sent to Camino's service.

Install only if you are comfortable sending the exact start and end coordinates you provide to api.getcamino.ai for processing. Protect the Camino API key stored in Claude settings, and review the referenced GitHub repository before using the npx install path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation instructs users to run shell commands and invoke a local shell script, but the skill declares no permissions for shell/code execution. This creates a trust and capability mismatch: an agent or user may execute shell-based installation or runtime steps without an explicit permission boundary, increasing the risk of unintended command execution or abuse if the referenced repository or scripts are modified.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends precise user-supplied start/end coordinates to a third-party API, but the script only presents technical usage information and does not clearly warn that location data leaves the local environment. Location data can be sensitive personal information, and silent transmission increases privacy and compliance risk when users may assume the computation is local.

External Transmission

Medium
Category
Data Exfiltration
Content
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
Confidence
94% confidence
Finding
curl -s -X POST \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "Content-Type: application/json" \ -H "X-Client: claude-code-skill" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/relationship" | jq .
Confidence
91% confidence
Finding
https://api.getcamino.ai/

VirusTotal

No VirusTotal findings

View on VirusTotal