Journey

PassAudited by ClawScan on May 13, 2026.

Overview

This is a straightforward route-planning skill that sends your chosen waypoints to Camino using an API key; review the external-service and install-source details before use.

This skill appears coherent and purpose-aligned. Before installing, decide whether you are comfortable sending route waypoints and itinerary context to Camino, store the API key carefully, and use a scoped install rather than installing the entire companion suite unless you need it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone with access to the configured environment could potentially use the Camino API key.

Why it was flagged

The skill requires a service API key and recommends storing it persistently in Claude Code settings. This is disclosed and purpose-aligned for the Camino API, but users should treat it as a sensitive credential.

Skill content

authenticate via the `CAMINO_API_KEY` environment variable ... Add to your `~/.claude/settings.json`: { "env": { "CAMINO_API_KEY": "your-api-key-here" } }

Recommendation

Use a dedicated Camino key with the least access available, avoid sharing logs/settings that contain it, and rotate it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your submitted locations, trip purposes, and constraints leave your machine and are processed by Camino.

Why it was flagged

The script sends the user-provided waypoint JSON to Camino's external API. This is central to the skill's purpose and clearly disclosed, but the data may include sensitive location or itinerary details.

Skill content

curl -s -X POST ... -d "$INPUT" ... "https://api.getcamino.ai/journey" | jq .

Recommendation

Only submit itinerary details you are comfortable sending to Camino, especially for private home, work, client, or travel-security locations.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing from the repo or installing all companion skills could expand the agent's available behavior beyond this one route-planning script.

Why it was flagged

The documentation includes a user-directed, unpinned GitHub install command that can install the full companion skill suite, which may add more instructions or scripts than this single journey skill.

Skill content

Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

Recommendation

Prefer the scoped ClawHub install or the specific-skill install, and review or pin the GitHub source if installing directly from the repository.