ClawHub
Back to skill

Security audit

Safety Checker

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed location lookup tool that sends user-provided coordinates to Camino's API to find nearby safety resources.

Install only if you are comfortable sending the coordinates and radius you enter to Camino's API using your Camino API key. Use the least precise location that still works for your safety check, and install only this skill rather than the full suite if you do not need the other Camino tools.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation instructs users to execute local shell scripts and curl commands, but the skill declares no permissions to reflect that shell capability. This mismatch can weaken user trust boundaries and allow a skill to invoke command execution paths without transparent permission signaling, especially in agent environments that rely on declared permissions for policy enforcement.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends precise latitude/longitude and radius data to a third-party API, but provides no runtime disclosure, consent prompt, or data-handling notice to the user. Because location data is sensitive, transmitting it externally without explicit user awareness can expose private movement or whereabouts information and creates a privacy/security risk even if the destination service is legitimate.

External Transmission

Medium
Category
Data Exfiltration
Content
}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
Confidence
89% confidence
Finding
curl -s -X POST \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "Content-Type: application/json" \ -H "X-Client: claude-code-skill" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .
Confidence
87% confidence
Finding
https://api.getcamino.ai/

VirusTotal

No VirusTotal findings

View on VirusTotal