ClawHub
Back to skill

Security audit

Travel Planner

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill does what it says, but users should understand that trip details and an API key are sent to Camino's external service.

Install only if you are comfortable sharing trip waypoints, purposes, constraints, your Camino API key, and any trial-signup email with Camino. Prefer a pinned release or reviewed commit instead of mutable install commands when available, and avoid submitting sensitive home, medical, client, or security-related locations unless necessary.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Installers and Mutable Skill Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-23
Vulnerability Type: Supply-chain risk from unpinned dependencies and mutable sources
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill travel-planner
bash
npx clawhub@latest install travel-planner
# or: pnpm dlx clawhub@latest install travel-planner
# or: bunx clawhub@latest install travel-planner

Technical Analysis

The documented installation commands execute npm-distributed installer tools and retrieve Skill content without pinning the tools or downloaded content to reviewed, immutable versions.

The @latest tag is mutable and can resolve to a different package version each time the command is executed. Likewise, the GitHub repository URL does not specify a reviewed commit hash or signed release. Consequently, the code and instructions installed by these commands can change after this artifact has been audited.

An attacker who compromises an upstream package, package-publishing account, repository, maintainer account, or mutable release could distribute malicious code or Skill instructions through these otherwise legitimate-looking installation commands.

Attack Path

  1. An attacker compromises the clawhub or skills package distribution channel, a relevant publisher account, or the referenced GitHub repository.
  2. The attacker publishes a malicious package version or modifies the repository content retrieved by the unpinned URL.
  3. A user follows the installation instructions in SKILL.md.
  4. npx, pnpm dlx, or bunx downloads and executes the attacker-controlled installer version, or the installer retrieves attacker-controlled Skill content.
  5. The malicious component operates with the permissions and environment available ...[truncated 537 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version.
  2. Pin GitHub installation sources to a reviewed commit hash rather than a mutable branch.
  3. Publish and verify cryptographic integrity hashes for downloaded artifacts.
  4. Prefer signed releases and configure the installer to verify signatures before execution.
  5. Use package-manager lockfiles or equivalent integrity metadata where applicable.
  6. Review new package and Skill versions before updating documented pins.
  7. Run installation in a least-privileged, isolated environment without unnecessary credentials.
  8. Avoid executing remotely sourced package installers directly when an independently verifiable download-and-review workflow is available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents shell-based installation and execution flows but does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, this can cause overly broad shell access assumptions and weakens the safety boundary, making accidental command execution or misuse harder to constrain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or immutable reference allows whatever content is current at install time to be fetched and executed. This creates a supply-chain risk where a compromised upstream package or repository state could deliver different or malicious code to users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill-specific npx skills add ... --skill travel-planner command still references an unpinned remote repository. Even if only one skill is requested, the installation path depends on mutable upstream content and exposes users to repository or package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx clawhub@latest install travel-planner explicitly tracks the latest published version, which is mutable and can change between runs. If the package publisher account or package supply chain is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is specifically designed to send waypoint coordinates, itinerary structure, and possibly user intent to an external API, but the documentation does not clearly warn users that precise location data will leave the local environment. Because travel itineraries can reveal sensitive habits, lodging, meetings, and movement patterns, the missing privacy notice materially increases exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The trial setup sends the user's email address to an external service to obtain an API key. While functionally expected, it is still external transmission of personal data, and the documentation does not prominently frame the privacy implications or what the service will do with that data.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The documented curl example sends detailed waypoint coordinates and travel constraints to https://api.getcamino.ai/journey, which is an external transmission of potentially sensitive location and itinerary data. In the context of a travel-planning skill, this is expected functionality, but it still poses privacy and profiling risk if users are not clearly warned.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

], "constraints": {"transport": "foot", "time_budget": "4 hours"} }'
"https://api.getcamino.ai/journey"

text

## Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends the full user-supplied itinerary JSON, including waypoint coordinates and trip details, to an external Camino API without any explicit user-facing disclosure at runtime. In a travel-planning skill, this data can reveal sensitive location patterns and plans, so undisclosed transmission creates a real privacy and data-handling risk even if it is functionally necessary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This curl invocation performs an outbound POST request to a third-party API and includes raw user input as the request body, which constitutes external transmission of potentially sensitive itinerary data. In the context of a travel planner, coordinates, destinations, and time constraints may expose user movement or future travel plans, so the transmission is security-relevant and not merely incidental.

Content

Scanner excerpt · scripts/travel-planner.sh (reported line 46)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The hardcoded remote endpoint confirms that the skill sends user trip data to an external domain under the vendor's control. While HTTPS is used, the main issue is that sensitive travel data leaves the local environment and is entrusted to a third party, which increases privacy and compliance risk if users are not clearly informed.

Content

Scanner excerpt · scripts/travel-planner.sh (reported line 51)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/journey" | jq .