ClawHub
Back to skill

Security audit

Safety Checker

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent location-safety API skill, but users should know it sends exact coordinates and setup email data to Camino and uses unpinned install commands.

Install only the safety-checker skill from a reviewed source if possible, avoid the all-skills install unless you need the broader suite, and understand that exact coordinates, search radius, context text, and trial setup email are sent to Camino's external service. Store the API key only where you are comfortable exposing it to Claude Code sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installers and Mutable Repository Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–24
Vulnerability Type: Supply-chain risk caused by unpinned executable dependencies and mutable source references
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill safety-checker
bash
npx clawhub@latest install safety-checker
# or: pnpm dlx clawhub@latest install safety-checker
# or: bunx clawhub@latest install safety-checker

Technical Analysis

The documented installation commands download and execute third-party npm tooling without pinning it to an immutable, reviewed version. The explicit @latest reference selects whichever clawhub release is current at installation time. The unversioned skills package similarly allows the npm registry to determine the executed version.

The GitHub installation source references a mutable repository rather than a reviewed commit SHA or cryptographically verified release artifact. Consequently, the code installed by these commands can change after this audit without any modification to the audited project.

Package runners such as npx, pnpm dlx, and bunx may execute downloaded package code and lifecycle behavior under the privileges of the invoking user. Installing every companion skill also unnecessarily increases the amount of third-party code trusted by the user.

Attack Path

  1. An attacker compromises the publisher account, npm package, GitHub repository, release process, or another relevant supply-chain component.
  2. The attacker publishes a malicious package version or modifies the mutable repository content.
  3. A user follows the installation instructions in SKILL.md.
  4. The package runner retrieves the current unpinned dependency or repository state.
  5. Malicious installer, lifecycle ...[truncated 775 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin npm tools to exact, reviewed versions instead of using unversioned packages or @latest.
  2. Commit and verify package-manager lockfiles where installation occurs, and enforce registry integrity hashes.
  3. Reference the GitHub repository using a reviewed commit SHA rather than its mutable default branch.
  4. Prefer signed, checksummed release artifacts and document how users can verify signatures or hashes before installation.
  5. Recommend installing only the required safety-checker skill rather than all companion skills.
  6. Run installation in a least-privileged, isolated environment without unnecessary credentials or access to sensitive files.
  7. Establish a dependency-review process for version updates, including publisher verification and inspection of package lifecycle scripts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to modify ~/.claude/settings.json, which is a sensitive agent configuration location. While adding an API key there is common, directing users to edit agent config increases risk because mistakes or future malicious modifications in similar instructions could alter trusted runtime behavior or expose secrets broadly to other skills.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell-based installation and execution but does not declare any explicit tool scope such as allowed-tools or permissions. That makes the skill's operational capabilities less transparent to the agent/runtime and can lead to overbroad shell access being granted implicitly when users run installation or helper scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The installation command uses npx skills add against a remote GitHub repository without pinning a specific version, tag, or commit. This creates a supply-chain risk because future upstream changes could alter what gets installed, including malicious or compromised content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The skill-specific npx skills add command still references an unpinned remote repository, so the installed content may change over time. An attacker controlling or compromising the upstream source could deliver modified skill definitions or scripts to users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

npx clawhub@latest install safety-checker uses the moving latest tag, which is not reproducible and may fetch a different package version in the future. If the package or distribution channel is compromised, users may execute unreviewed code or install altered skill content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill's core function requires transmitting precise latitude/longitude to a third-party API, but the documentation does not clearly warn users that sensitive location data leaves the local environment. In a safety-oriented context, location can be especially sensitive because it may reveal where a user lives, stays, or travels at night.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The documented trial setup sends a user email address to an external service to obtain an API key. This is a real external data transmission and should be treated as privacy-relevant, especially since users may not realize they are disclosing personal information to a third party during setup.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The usage example explicitly posts precise coordinates and contextual safety information to an external API. In this skill's context, that is expected functionality, but it still creates a meaningful privacy and surveillance risk because it can disclose a user's exact whereabouts and movement-related intent.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"location": {"lat": 40.7506, "lon": -73.9935}, "radius": 500, "context": "late night safety: 24-hour businesses, transit, police, hospitals"}'
"https://api.getcamino.ai/context"

text

## Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits precise latitude/longitude and radius to a third-party API, but provides no user-facing disclosure, consent prompt, or indication that sensitive location data leaves the local environment. Because this skill is explicitly marketed for safety use, users may reasonably assume it performs a local lookup, making the undisclosed exfiltration of precise location data a real privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This curl invocation performs the actual outbound transmission of user-supplied location data and the API key to an external service. External transmission is expected for this skill's function, but it remains a true security/privacy concern because sensitive geolocation is sent off-host without any warning, consent flow, or visible safeguards beyond HTTPS.

Content

Scanner excerpt · scripts/safety-checker.sh (reported line 67)May include surrounding context.

sh
}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The hardcoded external endpoint confirms that the skill sends user location data to a third-party service outside the user's environment. In a location-safety skill, the sensitivity of the data is elevated because users may query their current whereabouts at night, which can reveal routines or vulnerable situations if mishandled.

Content

Scanner excerpt · scripts/safety-checker.sh (reported line 72)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .