ClawHub
Back to skill

Security audit

Location Context

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward location-context API wrapper, but users should understand that it sends coordinates and optional context to Camino AI and stores an API key for reuse.

Install only if you are comfortable sending requested location coordinates, radius, optional context, and weather-related options to Camino AI. Use a least-privilege API key, avoid sensitive exact locations or private meeting details, and prefer pinned install sources when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installation Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-23
Vulnerability Type: Supply-chain exposure through mutable, unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill context
bash
npx clawhub@latest install context
# or: pnpm dlx clawhub@latest install context
# or: bunx clawhub@latest install context

Technical Analysis

The documented installation commands resolve and execute third-party package-manager tooling without immutable version or integrity constraints. The clawhub@latest reference is explicitly mutable, the skills CLI has no exact version, and the GitHub source is not pinned to a reviewed commit hash or signed release.

As a result, these commands may install or execute content that differs from the version reviewed during this audit. This does not establish that the current dependencies are malicious; it creates a supply-chain weakness whereby a future compromised or malicious release could affect users following the documented instructions.

Attack Path

  1. An attacker compromises a referenced npm publishing account, package, GitHub repository, or maintainer account.
  2. The attacker publishes a malicious version of the CLI or modifies the repository's default branch.
  3. A user follows an installation command from SKILL.md.
  4. The package manager resolves the mutable or unpinned source controlled by the attacker.
  5. Malicious installation logic or altered Skill content is downloaded and executed or installed with the invoking user's privileges.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account running the installation command. Depending on that account's permissions and environment, the malicious dependency could access user-readable files, environment ...[truncated 235 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed CLI version.
  • Pin the skills CLI to an exact version rather than relying on package-manager resolution of the current release.
  • Pin GitHub installation sources to a reviewed commit SHA or immutable signed release tag.
  • Publish and verify cryptographic integrity hashes or signatures for downloaded artifacts.
  • Use package-manager lockfiles where applicable and enable provenance or signature verification.
  • Review downloaded Skill files and lifecycle scripts before execution.
  • Document a controlled upgrade process that requires security review before changing pinned versions or commit hashes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to place an API key into ~/.claude/settings.json, which is an agent configuration location that may be readable by the agent runtime or other skills. While this is common setup guidance, it increases secret exposure risk if configuration files are later accessed, logged, or exfiltrated by another tool or compromised skill.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly instructs users to run shell commands and scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent platform to expose broader shell capability than users expect, increasing the chance of unintended command execution or weak policy enforcement.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The installation command uses npx skills add without pinning a specific version. This creates a supply-chain risk because future or compromised package versions could change behavior and execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This is another unpinned npx skills add invocation, so it carries the same supply-chain exposure as the previous finding. Users may believe they are installing a stable reviewed skill, while the actual installed code can vary over time.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The command npx clawhub@latest install context explicitly tracks the latest version, which is inherently mutable. If the upstream package is compromised or a breaking change is introduced, users may execute unreviewed code during install.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends precise coordinates, optional contextual queries, and possibly time/weather-related context to an external API, but the description does not clearly warn users about that data flow. In a location-intelligence skill, this omission is more sensitive because location and context can reveal habits, meetings, or personal interests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example sends precise latitude/longitude, radius, and free-form context to an external API. In the context of this skill, that is core functionality, but it still presents a real privacy/security risk because sensitive user location and intent data leave the local environment and the documentation does not prominently warn about that.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

curl -X POST -H "X-API-Key: $CAMINO_API_KEY"
-H "Content-Type: application/json"
-d '{"location": {"lat": 40.7589, "lon": -73.9851}, "radius": 500, "context": "lunch options"}'
"https://api.getcamino.ai/context"

text

## Parameters

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/context.sh (reported line 46)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/context" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/context.sh (reported line 51)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/context" | jq .

Static analysis

No suspicious patterns detected.