ClawHub
Back to skill

Security audit

Route

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward routing skill that calls Camino's API, with privacy and supply-chain cautions but no evidence of hidden or malicious behavior.

Install only from a source/version you trust, preferably a pinned release. Use this skill only for locations you are comfortable sending to Camino's API, because origin/destination coordinates, optional route details, your API key, and trial signup email data are transmitted to Camino-controlled endpoints.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/route.sh:35
Finding

Unvalidated and Unencoded Input Permits Route Query Manipulation

Content
View full analysis
&2 exit 1 fi if [ -z "$END_LAT" ] || [ -z "$END_LON" ]; then echo "Error: 'end_lat' and 'end_lon' are required" >&2 exit 1 fi # Build query string from JSON input build_query_string() { local params="start_lat=${START_LAT}&start_lon=${START_LON}&end_lat=${END_LAT}&end_lon=${END_LON}" # Optional parameters local mode=$(echo "$INPUT" | jq -r '.mode // empty') local include_geometry=$(echo "$INPUT" | jq -r '.include_geometry // empty') local include_imagery=$(echo "$INPUT" | jq -r '.include_imagery // empty') [ -n "$mode" ] && params="${params}&mode=${mode}" [ -n "$include_geometry" ] && params="${params}&include_geometry=${include_geometry}" [ -n "$include_imagery" ] && params="${params}&include_imagery=${include_imagery}" echo "$params" } QUERY_STRING=$(build_query_string) # Make API request curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/route?${QUERY_STRING}" | jq . ``` ### Technical Analysis The script only verifies that the input is syntactically valid JSON and that the required fields produce nonempty strings. It does not verify that coordinates are finite JSON numbers, enforce valid geographic ranges, restrict `mode` to the documented values, or require the two optional flags to be booleans. Values extracted by `jq -r` are directly concatenated into the query st ...[truncated 1853 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill demonstrates shell-based installation and execution paths but does not declare an explicit tool scope such as permissions or allowed-tools. That increases the chance an agent may invoke shell capabilities more broadly than intended, reducing containment and making misuse or accidental execution of unsafe commands easier.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or immutable commit allows the fetched code to change over time. If the upstream package or repository is compromised, users may install malicious or altered skill content without noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx skills add https://github.com/barneyjm/camino-skills --skill route references remote code without pinning to a specific commit or version. This creates a supply-chain risk because future repository changes can silently alter what gets installed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Invoking npx clawhub@latest install route uses the moving latest tag, which can resolve to different code over time. This exposes users to supply-chain attacks or unexpected behavior if a malicious or breaking version is published.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill is specifically designed to send precise origin/destination coordinates and optionally street-level imagery to an external API, but the description does not warn about that privacy sensitivity. In routing context, this omission is meaningful because location pairs can reveal home/work patterns, habits, or other sensitive movement data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The trial signup command transmits a user email address to an external service to obtain an API key. While expected for service enrollment, it is still an external data transfer and should be treated as sensitive because users may not realize they are disclosing personal information to a third party.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The route request sends precise start and end coordinates plus an API key to an external API. In the context of a routing skill, this is expected functionality, but it remains privacy-sensitive because location data can directly identify residences, workplaces, or travel patterns if logged, intercepted, or mishandled by the third party.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/route?start_lat=40.7128&start_lon=-74.0060&end_lat=40.7589&end_lon=-73.9851&mode=car"

Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script performs an HTTP request to a third-party service using start/end coordinates derived from user input, which can reveal sensitive location data. While the file name and comments indicate routing behavior, the script itself provides no explicit warning or disclosure at the point of transmission about sending user location data off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/route?${QUERY_STRING}" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/route.sh (reported line 75)May include surrounding context.

sh
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/route?${QUERY_STRING}" | jq .