Travel Planner
AdvisoryAudited by Static analysis on May 13, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill requires exposing a Camino API key in the agent environment, and calls may consume the user's Camino quota or account allowance.
The script sends the Camino API key to the Camino journey endpoint. This is disclosed and necessary for the stated integration, but it is still account credential usage.
-H "X-API-Key: $CAMINO_API_KEY"
Use a dedicated Camino API key if possible, avoid sharing logs or settings that contain it, and rotate the key if it may have been exposed.
Locations, route preferences, and trip purposes entered into the skill leave the local machine and are sent to Camino.
The user-provided itinerary JSON is posted to Camino's external API. This is purpose-aligned, but waypoint coordinates and stop purposes can be sensitive location or travel-planning data.
-d "$INPUT" \
"https://api.getcamino.ai/journey"Only include locations and plans you are comfortable sending to Camino, and avoid sensitive home, workplace, or private-trip details unless you trust the provider's data handling.
Following the broad companion-skill install command may install additional skills with their own capabilities and credentials.
The documentation includes a user-directed install command from a GitHub repository and also suggests installing all available Camino skills. No automatic execution is shown, but installing a whole repo can add more skills than this one.
npx skills add https://github.com/barneyjm/camino-skills
Prefer installing only camino-travel-planner unless you have reviewed and want the full Camino skill suite.
Invoking the skill performs an external API call and may consume API quota, but the artifacts do not show hidden commands or unrelated system actions.
The skill uses a local shell script with curl and jq to make the Camino API request. This is central to the stated purpose, and the provided script quotes the input and validates JSON before sending it.
curl -s -X POST
Review the JSON before running the script and keep normal command-execution approvals enabled for agent-initiated use.