Ev Charger Locations
Analysis
The skill appears to do what it claims—find EV chargers via Camino—but users should understand it sends search/location data to Camino and uses a Camino API key.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Install all available skills from repo npx skills add https://github.com/barneyjm/camino-skills
The installation guidance optionally encourages installing a broader remote skill repository, which may include skills beyond the reviewed EV charger artifact.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
-H "X-API-Key: $CAMINO_API_KEY"
The script authenticates to Camino using the user's API key, which is expected for this service integration but is still delegated account authority.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
"https://api.getcamino.ai/query?${QUERY_STRING}"The script sends the user's charger search terms and optional latitude/longitude/radius parameters to Camino's external API.