ClawHub
Back to skill

Security audit

Real Estate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Camino API helper for real-estate location lookups, with privacy and install-hygiene caveats users should understand before using it.

Install from a reviewed, pinned source when possible. Use this skill only if you are comfortable sending the address or coordinates you evaluate, the search radius, and your CAMINO_API_KEY to Camino's API. Avoid putting highly sensitive home-location searches through the service unless Camino's data handling terms are acceptable to you.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installation Commands Allow Supply-Chain Compromise

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill explicitly relies on shell execution (curl, jq, and a shell script) but does not declare a restrictive tool scope such as permissions or allowed-tools. That creates unnecessary ambiguity about what commands the agent may run and weakens least-privilege controls, increasing the chance of unintended command execution in environments that honor skill metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command uses npx skills add against a remote GitHub source without pinning a specific immutable version, tag, or commit. This creates a supply-chain risk: future upstream changes or repository compromise could cause users to install different code than expected.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This second npx skills add example also pulls from a mutable GitHub repository without pinning. Users following the documentation may unknowingly install altered code if the repository changes or is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

npx clawhub@latest install camino-real-estate uses the latest tag, which is inherently mutable and can resolve to unexpected code over time. If the package or dependency chain is compromised, users may execute attacker-controlled install logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill processes sensitive user-supplied addresses and coordinates and sends them to a third-party API, but the description does not clearly warn users about that data transfer. This is a privacy and consent issue because precise location data can be sensitive and users may not realize it leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill uses curl to transmit user-provided address/location data and an API key to an external service. External transmission is intrinsic to the skill's purpose, but it still presents a real security/privacy boundary because sensitive location data and credentials leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

./scripts/real-estate.sh '{"address": "350 Fifth Avenue, New York, NY", "radius": 500}'

text

### Via curl

```bash
# Step 1: Geocode the address

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This endpoint call sends geocoding queries containing a precise address to api.getcamino.ai. Even though this is expected functionality, it is still a genuine external data transfer risk because home addresses can be highly sensitive and may be logged or retained by the third party.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash
# Step 1: Geocode the address
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/query?query=742+Evergreen+Terrace+Springfield&limit=1"

# Step 2: Get context with real estate focus
curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The context request transmits precise coordinates and real-estate-related context to a third-party service, expanding the sensitivity of the shared data. In a real-estate evaluation skill, this is contextually expected, but it remains a meaningful privacy exposure because it can reveal where a user lives, works, or is considering moving.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"location": {"lat": 40.7589, "lon": -73.9851}, "radius": 1000, "context": "real estate evaluation: schools, transit, grocery, parks, restaurants, walkability"}'
"https://api.getcamino.ai/context"

text

## Parameters

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script sends the user's address to a remote geocoding API and later sends location and radius data to a remote context API. While the code validates inputs and checks for an API key, it does not provide any user-facing warning, prompt, or comment disclosing that user location data will be transmitted off-box.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 54)May include surrounding context.

sh
GEOCODE_RESULT=$(curl -s -X GET \
        -H "X-API-Key: $CAMINO_API_KEY" \
        -H "X-Client: claude-code-skill" \
        "https://api.getcamino.ai/query?query=${encoded_query}&limit=1")

    # Extract lat/lon from first result
    LAT=$(echo "$GEOCODE_RESULT" | jq -r '.results[0].lat // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 91)May include surrounding context.

sh
GEOCODE_RESULT=$(curl -s -X GET \
        -H "X-API-Key: $CAMINO_API_KEY" \
        -H "X-Client: claude-code-skill" \
        "https://api.getcamino.ai/query?query=${encoded_query}&limit=1")

    # Extract lat/lon from first result
    LAT=$(echo "$GEOCODE_RESULT" | jq -r '.results[0].lat // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/real-estate.sh (reported line 86)May include surrounding context.

sh
}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The script reads CAMINO_API_KEY from the environment and uses it in HTTP headers for outbound API requests. Although missing-key handling exists, there is no user-facing notice in the script that this credential will be used to authenticate remote requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.