ClawHub
Back to skill

Security audit

Route

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward routing skill that calls Camino's API, with privacy and supply-chain cautions but no evidence of hidden or malicious behavior.

Install only from a source/version you trust, preferably a pinned release. Use this skill only for locations you are comfortable sending to Camino's API, because origin/destination coordinates, optional route details, your API key, and trial signup email data are transmitted to Camino-controlled endpoints.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding
Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-22 **Vulnerability Type**: Unpinned executable dependencies and mutable installation sources **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill route ``` ```bash npx clawhub@latest install route # or: pnpm dlx clawhub@latest install route # or: bunx clawhub@latest install route ``` ### Technical Analysis The documented installation procedure executes npm-distributed command-line tools and installs content from a mutable GitHub repository reference. The npm package is selected through the `latest` tag, while the GitHub repository is not pinned to a commit hash or cryptographically verified release. Consequently, the code executed by these commands can change after this version of the Skill has been reviewed. A compromised npm package release, package-maintainer account, GitHub account, or upstream default branch could replace legitimate installation behavior with arbitrary code. This issue is limited to users who follow the documented installation commands. The audited runtime script itself does not dynamically retrieve or execute a remote payload. ### Attack Path 1. An attacker compromises the npm package, package-publishing credentials, GitHub repository, or upstream maintainer account. 2. The attacker publishes a malicious version under the `latest` tag or modifies the repository's mutable default branch. 3. A user follows one of the documented installation commands. 4. `npx`, `pnpm dlx`, or `bunx` downloads and executes the attacker-controlled package version. 5. The malicious installer runs with the privileges of the user performing the installation. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that accoun ...[truncated 398 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin each package runner dependency to an exact, audited version instead of using `@latest`. - Pin the GitHub source to a reviewed commit hash or immutable signed release tag. - Publish expected checksums or signatures and require verification before installation. - Prefer installing from a locked manifest with integrity metadata. - Document the exact versions and commit hashes that correspond to the audited Skill release. - Use a restricted, nonprivileged account or sandbox when running third-party installation tooling. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/route.sh:35
Finding
Unvalidated and Unencoded Input Permits Route Query Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/route.sh`, lines 35-75 **Vulnerability Type**: Improper input validation and missing URL encoding **Risk Level**: Medium ### Vulnerable Code ```bash # Check for required fields START_LAT=$(echo "$INPUT" | jq -r '.start_lat // empty') START_LON=$(echo "$INPUT" | jq -r '.start_lon // empty') END_LAT=$(echo "$INPUT" | jq -r '.end_lat // empty') END_LON=$(echo "$INPUT" | jq -r '.end_lon // empty') if [ -z "$START_LAT" ] || [ -z "$START_LON" ]; then echo "Error: 'start_lat' and 'start_lon' are required" >&2 exit 1 fi if [ -z "$END_LAT" ] || [ -z "$END_LON" ]; then echo "Error: 'end_lat' and 'end_lon' are required" >&2 exit 1 fi # Build query string from JSON input build_query_string() { local params="start_lat=${START_LAT}&start_lon=${START_LON}&end_lat=${END_LAT}&end_lon=${END_LON}" # Optional parameters local mode=$(echo "$INPUT" | jq -r '.mode // empty') local include_geometry=$(echo "$INPUT" | jq -r '.include_geometry // empty') local include_imagery=$(echo "$INPUT" | jq -r '.include_imagery // empty') [ -n "$mode" ] && params="${params}&mode=${mode}" [ -n "$include_geometry" ] && params="${params}&include_geometry=${include_geometry}" [ -n "$include_imagery" ] && params="${params}&include_imagery=${include_imagery}" echo "$params" } QUERY_STRING=$(build_query_string) # Make API request curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/route?${QUERY_STRING}" | jq . ``` ### Technical Analysis The script only verifies that the input is syntactically valid JSON and that the required fields produce nonempty strings. It does not verify that coordinates are finite JSON numbers, enforce valid geographic ranges, restrict `mode` to the documented values, or require the two optional flags to be booleans. Values extracted by `jq -r` are directly concatenated into the query st ...[truncated 1853 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Require coordinate fields to be JSON numbers and reject strings, arrays, objects, null values, NaN, and infinities. - Enforce latitude values between `-90` and `90` and longitude values between `-180` and `180`. - Restrict `mode` to an explicit allowlist containing only `car`, `bike`, and `foot`. - Require `include_geometry` and `include_imagery` to be JSON booleans. - Avoid manually constructing the query string. Use curl's encoding support, for example: ```bash curl --silent --show-error --fail --globoff --get \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ --data-urlencode "start_lat=$START_LAT" \ --data-urlencode "start_lon=$START_LON" \ --data-urlencode "end_lat=$END_LAT" \ --data-urlencode "end_lon=$END_LON" \ --data-urlencode "mode=$MODE" \ "https://api.getcamino.ai/route" ``` - Add optional parameters only after validating their types and values. - Use `--fail-with-body` or `--fail` so HTTP errors cause the script to fail instead of being treated as successful JSON output. - Add tests covering delimiter injection, duplicate parameters, curl globbing characters, invalid coordinate ranges, incorrect JSON types, and unsupported transport modes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Agent Config Directory Access

High
Category
Agent Snooping
Content
**Add your key to Claude Code:**

Add to your `~/.claude/settings.json`:

```json
{
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill demonstrates shell-based installation and execution paths but does not declare an explicit tool scope such as permissions or allowed-tools. That increases the chance an agent may invoke shell capabilities more broadly than intended, reducing containment and making misuse or accidental execution of unsafe commands easier.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Using `npx skills add https://github.com/barneyjm/camino-skills` without a pinned version or immutable commit allows the fetched code to change over time. If the upstream package or repository is compromised, users may install malicious or altered skill content without noticing.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The command `npx skills add https://github.com/barneyjm/camino-skills --skill route` references remote code without pinning to a specific commit or version. This creates a supply-chain risk because future repository changes can silently alter what gets installed.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
Invoking `npx clawhub@latest install route` uses the moving `latest` tag, which can resolve to different code over time. This exposes users to supply-chain attacks or unexpected behavior if a malicious or breaking version is published.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This skill is specifically designed to send precise origin/destination coordinates and optionally street-level imagery to an external API, but the description does not warn about that privacy sensitivity. In routing context, this omission is meaningful because location pairs can reveal home/work patterns, habits, or other sensitive movement data.

External Transmission

Medium
Category
Data Exfiltration
Content
**Instant Trial (no signup required):** Get a temporary API key with 25 calls:

```bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start
```
Confidence
90% confidence
Finding
The trial signup command transmits a user email address to an external service to obtain an API key. While expected for service enrollment, it is still an external data transfer and should be treated as sensitive because users may not realize they are disclosing personal information to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/route?start_lat=40.7128&start_lon=-74.0060&end_lat=40.7589&end_lon=-73.9851&mode=car"
```

## Parameters
Confidence
93% confidence
Finding
The route request sends precise start and end coordinates plus an API key to an external API. In the context of a routing skill, this is expected functionality, but it remains privacy-sensitive because location data can directly identify residences, workplaces, or travel patterns if logged, intercepted, or mishandled by the third party.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script performs an HTTP request to a third-party service using start/end coordinates derived from user input, which can reveal sensitive location data. While the file name and comments indicate routing behavior, the script itself provides no explicit warning or disclosure at the point of transmission about sending user location data off-system.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/route?${QUERY_STRING}" | jq .
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/route?${QUERY_STRING}" | jq .
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.