Fitness Finder

PassAudited by ClawScan on May 13, 2026.

Overview

The skill appears to be a straightforward Camino fitness-location search wrapper, but it requires a Camino API key and sends your search/location details to Camino.

Install this if you are comfortable with Camino receiving your fitness search queries and locations and with the skill using your Camino API quota. Keep CAMINO_API_KEY private, and install only the specific fitness-finder skill unless you intentionally want the full Camino suite.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill will rely on your Camino API key and may consume your Camino quota or account entitlement.

Why it was flagged

The script reads a provider API key from the environment and uses it to authenticate to Camino's API. This is sensitive account authority, but it matches the declared integration.

Skill content

-H "X-API-Key: $CAMINO_API_KEY" ... "https://api.getcamino.ai/query?${QUERY_STRING}"

Recommendation

Keep the API key private, avoid committing agent settings that contain it, and use a scoped or limited key if Camino offers one.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Camino can receive the locations and fitness searches you ask the skill to perform.

Why it was flagged

The user's search terms and optional latitude/longitude are sent to Camino's external API. This is disclosed and purpose-aligned for a location search skill.

Skill content

local query=$(echo "$INPUT" | jq -r '.query // "gyms yoga studios fitness centers"') ... [ -n "$lat" ] && params="${params}&lat=${lat}" ... "https://api.getcamino.ai/query?${QUERY_STRING}"

Recommendation

Avoid entering sensitive home/work locations if that privacy tradeoff is not acceptable, and review Camino's privacy and data-retention practices.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the whole companion suite may give your agent more tools than you intended to install.

Why it was flagged

The documentation suggests a user-directed install from a remote GitHub repository and optionally installing the entire Camino skills suite, which expands the reviewed surface beyond this single skill.

Skill content

Install all available skills ... npx skills add https://github.com/barneyjm/camino-skills

Recommendation

Prefer the specific-skill install command unless you want the full suite, and review companion skills separately before installing them.