Safety Checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 PM UTC
• Version: 2.0.1

Overview

The core safety-checking behavior is coherent, but the install instructions rely on mutable remote sources and promote installing a broader skill suite outside this reviewed artifact.

Review before installing. Prefer a pinned ClawHub version or immutable Git commit, install only camino-safety-checker rather than the full companion suite, and only use it when you are comfortable sending the queried coordinates, radius, and API key to Camino's external API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package and Repository Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–26
Vulnerability Type: Unpinned and mutable third-party installation sources
Risk Level: Medium

Vulnerable Code

bash

# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill camino-safety-checker

bash

npx clawhub@latest install camino-safety-checker
# or: pnpm dlx clawhub@latest install camino-safety-checker
# or: bunx clawhub@latest install camino-safety-checker

Technical Analysis

The documented installation commands execute package tooling and install content obtained from mutable remote sources. The GitHub repository URL is not pinned to an immutable commit, while the @latest package tag deliberately resolves to whichever release is current when the command runs. No version pin, commit hash, integrity digest, or signature-verification procedure is provided.

Consequently, the code executed or installed by these commands may differ from the content that was audited. Installing all Skills from the repository further expands the trust boundary to companion Skills that are not present in this project artifact. This is a supply-chain weakness; the audited script itself does not contain evidence of an embedded malicious payload.

Attack Path

1. An attacker compromises the upstream package, repository, release process, registry account, or maintainer credentials.
2. The attacker publishes malicious package code under the mutable latest tag or modifies the repository's current contents.
3. A user follows one of the documented npx, pnpm dlx, or bunx installation commands.
4. The package runner retrieves the attacker-controlled version and may execute its lifecycle or command-line code under the user's account.
5. The malicious installer can act with the filesystem, network, environmen ...[truncated 663 chars]

Remediation

View remediation

Remediation Suggestions

• Pin package runners to audited, exact package versions instead of using @latest.
• Pin GitHub installations to an immutable, reviewed commit hash or signed release tag.
• Provide cryptographic integrity hashes or signature-verification instructions for downloaded artifacts.
• Install only the required Skill rather than the entire companion suite.
• Review package lifecycle scripts and dependency trees before installation.
• Use a lockfile where supported and enable registry provenance or signature verification.
• Run installation with least privilege in an isolated environment without unnecessary credentials.
• Establish a controlled update process in which new versions are reviewed before changing the documented pins.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json

{

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires shell-capable binaries (curl, jq) but does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent environment, this creates unnecessary ambient authority: an agent invoking the skill may have broader shell access than is needed, increasing the risk of unintended command execution or abuse if downstream scripts are modified or inputs are mishandled.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx skills add https://github.com/barneyjm/camino-skills without a pinned version or commit causes installation to trust the latest remote state of the package/repository. That introduces a supply-chain risk: a future malicious or compromised update could change what gets installed and executed in agent environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The instruction to install a specific skill from a GitHub repository via npx skills add ... --skill camino-safety-checker still relies on an unpinned remote source. Even though the selected skill is narrower, the fetched repository contents can change over time, enabling supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

npx clawhub@latest install camino-safety-checker uses a floating latest package version, which can silently pull new code at install time. In a compromised publisher or dependency scenario, this can lead to execution of unintended code during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

./scripts/safety-checker.sh '{"location": {"lat": 37.7749, "lon": -122.4194}, "radius": 800}'

text

### Via curl

```bash
curl -X POST -H "X-API-Key: $CAMINO_API_KEY" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script transmits precise latitude/longitude and search radius to a third-party API, which is sensitive location data. Although this is functionally necessary for the skill, the script provides no explicit user-facing disclosure, consent prompt, or minimization controls, so users may unknowingly expose precise whereabouts to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This POST request sends user-supplied location context and an API key to an external network endpoint. The transmission itself is over HTTPS and not obviously malicious, but in a safety-focused skill handling late-night location queries, disclosure and privacy handling are important because precise location can reveal highly sensitive movement or presence information.

Content

Scanner excerpt · scripts/safety-checker.sh (reported line 67)May include surrounding context.

sh

}')

# Make context API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/safety-checker.sh (reported line 72)May include surrounding context.

sh

-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$CONTEXT_BODY" \
    "https://api.getcamino.ai/context" | jq .

Static analysis

No suspicious patterns detected.