T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Mutable and Unpinned Installation Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Fitness Finder
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Camino fitness-search skill, with ordinary privacy and supply-chain cautions rather than evidence of hidden or malicious behavior.
Before installing, use a dedicated Camino API key, avoid sending sensitive precise locations unless needed, and prefer a pinned release or reviewed commit instead of mutable latest or default-branch install commands. Installing only camino-fitness-finder is lower scope than installing the full companion suite.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/fitness-finder.sh:45- Finding
Unvalidated JSON Values Are Concatenated into the Request URL
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Add your key to Claude Code:
Add to your
~/.claude/settings.json:json {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises shell-based usage and declares runtime requirements for curl and jq, but it does not define an explicit tool scope such as allowed-tools or permissions. That can cause an agent platform to overgrant shell access or leave execution boundaries ambiguous, increasing the chance of unintended command execution beyond the skill's intended network-query behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The installation instruction uses
npx skills addfrom a remote GitHub repository without pinning a specific version, tag, or commit. This creates a supply-chain risk because future changes to the package or repo contents could silently alter what gets installed and executed.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
This second
npx skills addexample also installs from a mutable remote repository state without version pinning. Users following the command may execute changed code later than what was originally reviewed, enabling supply-chain compromise or unexpected behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The
npx clawhub@latest installinstruction explicitly trackslatest, which is a mutable target. If the upstream package is compromised or introduces unsafe changes, users will fetch and run it automatically.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill demonstrates sending requests, including location parameters and an API key header, to
https://api.getcamino.ai/query, which is an external transmission. This is inherent to the skill's purpose, but it still presents a real data exposure surface because sensitive query and location data leave the local environment and the credential is used against a third-party service.- Content
bash curl -H "X-API-Key: $CAMINO_API_KEY" \ "https://api.getcamino.ai/query?query=gyms+yoga+studios+fitness+centers&lat=40.7589&lon=-73.9851&radius=1500&rank=true"Parameters
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends user-supplied search text and potentially precise latitude/longitude to a third-party API without any explicit disclosure, consent, or minimization. Because location data can be sensitive, this creates a privacy risk even though the transmission is functionally necessary for the skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill clearly relies on a remote Camino API and location-based queries, but it does not prominently warn users that location data and API credentials will be transmitted off-box. For a location intelligence skill this data flow is expected, yet the missing explicit privacy warning can still lead to inadvertent sharing of sensitive location information.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest presents this skill as a fitness-facility search tool, but the code also depends on reading a secret from the process environment. Accessing environment-stored credentials is an additional capability not mentioned in the stated purpose, even though it is used to call the backend service.
- Content
Static analysis
No suspicious patterns detected.