ClawHub
Back to skill

Security audit

Query

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wrapper around Camino's location-search API and its network/API-key behavior matches that purpose.

Install only from a source you trust, prefer a pinned version or reviewed ClawHub package over mutable npx/GitHub commands, and treat CAMINO_API_KEY as a secret because the skill will send it with your search query and optional location parameters to Camino's API.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Installation Commands Permit Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-22
Vulnerability Type: Mutable and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill camino-query

Via clawhub:

bash
npx clawhub@latest install camino-query
# or: pnpm dlx clawhub@latest install camino-query
# or: bunx clawhub@latest install camino-query

Technical Analysis

The documented installation commands download and execute third-party content without pinning it to a reviewed package version, immutable Git commit, or integrity hash. The GitHub commands track mutable repository content, while the @latest package selector explicitly resolves to whichever release is current at installation time.

Consequently, the code executed by these commands can differ from the code that was originally reviewed. Exploitation requires compromise or malicious control of an upstream package, publisher account, repository, release process, or another relevant software-distribution component.

Attack Path

  1. An attacker compromises an upstream package, publisher account, repository, or release pipeline referenced by the installation instructions.
  2. The attacker publishes or commits a malicious version while retaining the expected package or repository identity.
  3. A user follows one of the documented commands.
  4. npx, pnpm dlx, bunx, or the skill installer resolves and downloads the mutable upstream version.
  5. Malicious installation logic or skill content executes with the permissions of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, an attacker ...[truncated 363 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an explicitly reviewed, exact package version.
  • Pin Git-based installations to a full immutable commit SHA rather than a mutable branch or repository head.
  • Publish and verify cryptographic checksums or signatures for released packages and skill artifacts.
  • Use package-manager lockfiles where applicable and enforce integrity metadata during installation.
  • Review installation lifecycle scripts and downloaded skill contents before execution.
  • Run installation with a non-privileged account in an isolated environment and avoid invoking these commands with elevated privileges.
  • Establish a controlled update process that reviews and tests each new dependency version before changing the pinned reference.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to place CAMINO_API_KEY into ~/.claude/settings.json, an agent config location that may be broadly accessible to the agent runtime and other skills. Storing secrets in a shared config path increases the blast radius if another skill, prompt injection, or shell action can read local configuration files.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly relies on shell execution via curl and jq, but it does not declare any permissions or allowed-tools scope. That creates an unnecessary trust gap: an agent may invoke shell-capable behavior without an explicit least-privilege declaration, making review and enforcement harder.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or commit means installs can silently pull changed code later. This is a supply-chain risk because users may receive modified skill content or scripts that were not part of the reviewed version.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill-specific install command still references an unpinned GitHub source, so the exact fetched content can change over time. An attacker who compromises the repo or release path could alter the installed skill or helper scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

npx clawhub@latest install camino-query requests the latest installer version, which is mutable and can introduce unreviewed behavior at install time. While common operationally, it still expands supply-chain exposure because the installer itself is not fixed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code sends the user's query and optional parameters such as lat/lon to an external Camino API via curl, but the script provides no confirmation prompt, logging message, or comment warning that user data will be transmitted off-system. For a code file, outbound network transmission of user or system data should have some visible disclosure unless clearly covered elsewhere.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/query.sh (reported line 96)May include surrounding context.

sh
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/query?${QUERY_STRING}" | jq .

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script reads the CAMINO_API_KEY environment variable and uses it in an outbound request header, but there is no comment or user-facing notice explaining that a credential from the environment will be accessed and transmitted to a third-party service. The existing error message only covers absence of the variable, not disclosure of this sensitive operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.