ClawHub
Back to skill

Security audit

Route

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide routing as advertised, but its mutable install instructions and sensitive location-data handling should be reviewed before use.

Install only from a reviewed, pinned source if possible, and avoid the all-skills install unless you intend to trust the entire Camino suite. Do not submit home, work, live, or otherwise sensitive locations unless you are comfortable sending those coordinates and optional imagery requests to Camino's API under your API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:15
Finding
Unpinned Third-Party Installers Create a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-24` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: High ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill camino-route ``` ```bash npx clawhub@latest install camino-route # or: pnpm dlx clawhub@latest install camino-route # or: bunx clawhub@latest install camino-route ``` ### Technical Analysis The installation instructions execute packages and retrieve Skill content from mutable external sources without pinning an immutable npm version, Git commit, or verified integrity digest. The `@latest` npm tag can resolve to a different package version over time. Likewise, installing directly from a GitHub repository without specifying a commit allows the downloaded content to change after this artifact has been audited. The instruction to install all companion Skills also expands the trusted codebase beyond the single audited Skill. Package runners such as `npx`, `pnpm dlx`, and `bunx` download and execute package code in the local user context. If the npm package, publisher account, GitHub account, repository, or distribution channel is compromised, altered installer code could execute without being represented in this audited project. No evidence was found that the currently reviewed `route.sh` script retrieves or executes remote code. The risk arises specifically from the documented installation process. ### Attack Path 1. An attacker compromises the referenced npm publisher, package, GitHub repository, maintainer account, or release process. 2. The attacker publishes a modified version under the mutable `latest` tag or changes the repository's default branch. 3. A user follows one of the documented installation commands. 4. The selected package runner downloads and executes the attacker-contro ...[truncated 720 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact package version, such as `clawhub@X.Y.Z`. 2. Pin Git-based installation to an immutable reviewed commit hash rather than the repository's default branch. 3. Publish and verify cryptographic checksums or package signatures before execution. 4. Use npm lockfiles and integrity metadata where supported. 5. Avoid recommending installation of the entire companion suite when only `camino-route` is required. 6. Review package lifecycle scripts before running package managers, and disable scripts where installation permits it. 7. Perform installation in a restricted container or sandbox with minimal filesystem access, no unnecessary credentials, and no elevated privileges. 8. Establish a controlled update process so newer versions are audited before changing the pinned reference. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/route.sh:37
Finding
Unvalidated and Unencoded Input Permits Authenticated Query-Parameter Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/route.sh:37-40, 52-62, 68-75` **Vulnerability Type**: Improper input validation and URL query construction **Risk Level**: Medium ### Vulnerable Code ```bash START_LAT=$(echo "$INPUT" | jq -r '.start_lat // empty') START_LON=$(echo "$INPUT" | jq -r '.start_lon // empty') END_LAT=$(echo "$INPUT" | jq -r '.end_lat // empty') END_LON=$(echo "$INPUT" | jq -r '.end_lon // empty') ``` ```bash build_query_string() { local params="start_lat=${START_LAT}&start_lon=${START_LON}&end_lat=${END_LAT}&end_lon=${END_LON}" # Optional parameters local mode=$(echo "$INPUT" | jq -r '.mode // empty') local include_geometry=$(echo "$INPUT" | jq -r '.include_geometry // empty') local include_imagery=$(echo "$INPUT" | jq -r '.include_imagery // empty') [ -n "$mode" ] && params="${params}&mode=${mode}" [ -n "$include_geometry" ] && params="${params}&include_geometry=${include_geometry}" [ -n "$include_imagery" ] && params="${params}&include_imagery=${include_imagery}" echo "$params" } ``` ```bash QUERY_STRING=$(build_query_string) # Make API request curl -s -X GET \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ "https://api.getcamino.ai/route?${QUERY_STRING}" | jq . ``` ### Technical Analysis The script verifies that the argument is valid JSON and that required values are nonempty, but it does not enforce the documented data types or value constraints: - Coordinates are not required to be numeric. - Latitude and longitude ranges are not checked. - `mode` is not restricted to `car`, `bike`, or `foot`. - Optional flags are not required to be JSON booleans. - Parameter values are concatenated into a URL without percent-encoding. - Curl URL globbing is not explicitly disabled. Because `jq -r` permits JSON strings to become raw shell-variable content, an input containing query delimiters such as `&` or `=` can introduce additional parameters into ...[truncated 1857 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Validate JSON types before extracting values: - Require all coordinate fields to have JSON type `number`. - Require `include_geometry` and `include_imagery` to have JSON type `boolean` when present. - Require `mode` to have JSON type `string`. 2. Validate coordinate ranges: - Latitude must be between `-90` and `90`. - Longitude must be between `-180` and `180`. 3. Allowlist transport modes to exactly `car`, `bike`, or `foot`. 4. Construct the request with curl's encoding support rather than manual concatenation: ```bash curl --silent --show-error --fail-with-body --globoff \ --get "https://api.getcamino.ai/route" \ -H "X-API-Key: $CAMINO_API_KEY" \ -H "X-Client: claude-code-skill" \ --data-urlencode "start_lat=$START_LAT" \ --data-urlencode "start_lon=$START_LON" \ --data-urlencode "end_lat=$END_LAT" \ --data-urlencode "end_lon=$END_LON" ``` 5. Add optional values as separate `--data-urlencode` arguments only after successful type and allowlist validation. 6. Use `jq -e` validation expressions so malformed types and out-of-range values cause an immediate failure. 7. Add negative tests for strings containing `&`, `=`, `%`, brackets, control characters, duplicate parameters, nonnumeric coordinates, and unsupported modes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Agent Config Directory Access

High
Category
Agent Snooping
Content
**Add your key to Claude Code:**

Add to your `~/.claude/settings.json`:

```json
{
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly instructs use of shell-based capabilities (`curl`, `jq`, and local scripts) but does not declare a restrictive tool scope such as `permissions` or `allowed-tools`. In an agent environment, undeclared shell capability increases the chance the skill can run broader commands than users expect, reducing transparency and weakening sandbox policy review.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding
Using `npx skills add https://github.com/barneyjm/camino-skills` without a pinned commit, tag, or package version creates a supply-chain risk because future upstream changes could alter the installed skill behavior. A user may install a different artifact than the one reviewed, including potentially malicious updates.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding
The specific-skill install example still references an unpinned GitHub source, so it has the same supply-chain exposure as the broader repo install. Because users are encouraged to copy-paste the command, they may unknowingly trust mutable remote content.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding
`npx clawhub@latest install camino-route` pulls the latest installer version at runtime, which is mutable and can change behavior unexpectedly. This introduces supply-chain and reproducibility risk, especially for a tool that installs agent skills with code-execution capability.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This routing skill sends precise origin and destination coordinates to an external API, but the skill description does not clearly warn users that their location data leaves the local environment. That omission can cause unintentional disclosure of sensitive travel patterns, home/work addresses, or live movement data.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-Key: $CAMINO_API_KEY" \
  "https://api.getcamino.ai/route?start_lat=40.7128&start_lon=-74.0060&end_lat=40.7589&end_lon=-73.9851&mode=car"
```

## Parameters
Confidence
90% confidence
Finding
The skill performs external transmission to `https://api.getcamino.ai/route`, including precise geolocation inputs and an API key header. Even though this is core to the skill's purpose, it remains a real security/privacy concern because sensitive location data is sent to a third party and could be logged, retained, or mishandled.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -X GET \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/route?${QUERY_STRING}" | jq .
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.