School Finder

PassAudited by ClawScan on May 13, 2026.

Overview

This is a coherent school-search skill that calls Camino AI with user-provided location queries and an API key, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

This skill appears safe to use for its stated purpose. Before installing, be aware that it needs your Camino API key and will send school-search locations to Camino AI; install only this skill rather than the full companion suite unless you want the additional capabilities.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your Camino API key will be available to this skill when it makes Camino API requests.

Why it was flagged

The skill requires a provider API key, which is sensitive account authority, but the requirement is clearly disclosed and aligned with the Camino API integration.

Skill content

These skills shell out to `curl` and authenticate via the `CAMINO_API_KEY` environment variable.

Recommendation

Use a Camino key with appropriate limits, keep it private, and remove it from Claude settings if you no longer use the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

School searches involving a home address or coordinates may be shared with Camino AI.

Why it was flagged

The script sends the user's search query and location parameters to Camino's API. This is expected for the stated purpose, but it means potentially personal location data leaves the local environment.

Skill content

curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .

Recommendation

Only submit locations you are comfortable sending to Camino, and review Camino's privacy and retention practices if the location is sensitive.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the full suite could add more agent capabilities than needed for school search.

Why it was flagged

The documentation recommends an optional bulk install of a broader skill suite from GitHub. This is user-directed and also provides a specific-skill install option, but it expands trust beyond the reviewed school-finder skill.

Skill content

Install all available skills from repo
npx skills add https://github.com/barneyjm/camino-skills

Recommendation

Prefer installing only `camino-school-finder` unless you have reviewed and want the companion skills.