ClawHub
Back to skill

Security audit

Relationship

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but users should notice that it sends exact coordinates to Camino's API and its install examples are not version-pinned.

Install only if you are comfortable sending the exact start and end coordinates you provide to api.getcamino.ai with a Camino API key. Avoid sensitive home, workplace, medical, or regulated-location data unless you understand Camino's data handling. Prefer a pinned version or commit instead of the mutable install examples, and install only the specific skill you need.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Remote Installation Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–25
Vulnerability Type: Supply-chain exposure through mutable remote dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill camino-relationship
bash
npx clawhub@latest install camino-relationship
# or: pnpm dlx clawhub@latest install camino-relationship
# or: bunx clawhub@latest install camino-relationship

Technical Analysis

The documented installation commands retrieve packages or Skill content from mutable upstream references. The GitHub commands do not specify a reviewed commit or immutable release, while the package-runner commands explicitly request @latest. No checksum, signature, lockfile, or other integrity-verification mechanism is documented.

Consequently, the content installed by users can differ from the content reviewed during this audit. This is an insecure dependency practice rather than evidence that the currently audited script contains an embedded malicious payload.

Attack Path

  1. An attacker compromises the upstream repository, registry package, maintainer account, release process, or another relevant supply-chain component.
  2. The attacker publishes malicious content to the repository's mutable default reference or to the package version selected by @latest.
  3. A user follows the installation instructions in SKILL.md.
  4. npx, pnpm dlx, or bunx retrieves the changed package, or the installer retrieves changed Skill content from GitHub.
  5. Depending on the upstream package's installation and execution behavior, attacker-controlled code or Skill instructions are executed or installed in the user's environment.

Impact Assessment

The potential impact is determined by the privileges of the user run ...[truncated 720 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an explicitly reviewed package version.
  2. Pin the GitHub dependency to an immutable commit hash or signed release tag rather than the repository's mutable default reference.
  3. Publish expected checksums or cryptographic signatures and verify them before installation.
  4. Use package-manager lockfiles and integrity metadata where supported.
  5. Install only the required Skill instead of the complete collection unless all included Skills have been independently reviewed.
  6. Document the expected publisher, version, commit, and integrity value so users can verify provenance.
  7. Run installation with the minimum necessary privileges in an isolated environment, and review package lifecycle scripts before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is described as if it performs local spatial calculations, but the content shows it actually sends user-supplied coordinates to a remote authenticated API. This mismatch is dangerous because users may disclose precise location data believing computation is local, while the skill depends on third-party network access and an API key.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly relies on shell execution (curl, jq, and ./scripts/relationship.sh) but does not declare any tool scope or allowed-tools restriction. That leaves the skill with undocumented execution capability, making it harder for users and reviewers to understand or constrain what commands may run.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or commit causes installation to fetch whatever code is current at execution time. If the upstream package or repository is changed, compromised, or hijacked, users may install unreviewed code with different behavior than the analyzed skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This installation path also references npx skills without pinning an immutable version of the fetched repository state. That creates supply-chain risk because the installed content can drift over time or be replaced after review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

npx clawhub@latest install camino-relationship explicitly tracks the latest version, which can change at any time and may introduce malicious or unsafe behavior after publication. Running latest-tagged install commands is a classic supply-chain weakness because it bypasses reproducibility and review stability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documentation indicates precise latitude/longitude pairs are transmitted to a third-party service, but it does not provide a user-facing privacy warning or consent guidance. Exact coordinates can reveal homes, workplaces, routines, or sensitive destinations, so omission of a privacy notice increases the risk of inadvertent sensitive-data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The documented curl usage sends user-provided coordinate data and an authentication header to an external service. External transmission is expected for this skill, but it is still a real security concern because it moves potentially sensitive location data and a secret-bearing request off the local system to a third party.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

}'

text

### Via curl

```bash
curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded remote endpoint https://api.getcamino.ai/relationship confirms that the skill transmits precise start/end locations to a third-party API. In the context of a location-intelligence skill, that behavior is functionally intended, but it still has meaningful privacy and data-governance implications if users are not clearly warned.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"start": {"lat": 40.7128, "lon": -74.0060}, "end": {"lat": 40.7589, "lon": -73.9851}}'
"https://api.getcamino.ai/relationship"

text

## Parameters

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script sends user-supplied location data and an API key to an external service via curl. This is a real data egress point: even if expected by the skill's purpose, it transmits potentially sensitive geolocation information off-host to a third party, which can create privacy, compliance, and secret-handling risk if users do not explicitly consent.

Content

Scanner excerpt · scripts/relationship.sh (reported line 52)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded external endpoint confirms that all input coordinates are sent to a remote Camino API. In the context of a relationship/distance skill this is functionally intended, but it still constitutes external transmission of sensitive location data to a third-party domain and therefore remains a genuine security/privacy concern rather than a false positive.

Content

Scanner excerpt · scripts/relationship.sh (reported line 57)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/relationship" | jq .

Static analysis

No suspicious patterns detected.