ClawHub

Broad Location Entity Query

v0.2.0

Search for places using natural language with Camino AI's location intelligence API. Returns relevant results with coordinates, distances, and metadata. Use...

⭐ 2· 654·0 current·0 all-time
by@james-southendsolutions
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Name/description, required environment variable (CAMINO_API_KEY), and code (scripts/query.sh) all align: the skill simply calls https://api.getcamino.ai/query with the API key. One minor inconsistency: the registry metadata at the top lists no required binaries, while the SKILL.md metadata and the script both require curl and jq. Functionally the binaries are necessary and used by the script.
✓
Instruction Scope
SKILL.md and scripts limit actions to building a URL-encoded query and calling Camino's API; the script validates JSON, checks for jq/curl, and sends the CAMINO_API_KEY in a request header. The instructions do tell the user to store the API key in ~/.claude/settings.json (a plaintext config), which is a usability/sensitivity note but not malicious. The skill does not instruct reading other unrelated files or transmitting data to unexpected endpoints.
ℹ
Install Mechanism
This is instruction-only with an included shell script (no automatic install spec). SKILL.md suggests installing via npx (pulling from a GitHub repo) or clawhub; using npx installs remote code and has the usual supply-chain considerations. The repository is a GitHub URL (reasonable), and there are no opaque archive downloads or extract steps in the provided files.
✓
Credentials
Only CAMINO_API_KEY is required and is declared as the primary credential. No unrelated secrets or multiple credentials are requested. Reminder: storing the key in ~/.claude/settings.json or other plaintext configs can expose it if that file is shared or backed up.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings in the provided files. Autonomous invocation is allowed by default (platform behavior) but the skill itself does not escalate privileges or persist beyond its normal files.
Assessment
This skill appears to do what it says: it builds a query and calls Camino's API using CAMINO_API_KEY. Before installing or using it, verify you trust api.getcamino.ai and the repository owner. Prefer giving it a limited-scope or trial API key (the SKILL.md documents a trial endpoint). Be cautious storing the API key in plaintext (~/.claude/settings.json); consider using a secret store or environment variable limited to the process. If you plan to run the npx install command, inspect the remote repo first (or clone it) rather than running arbitrary install scripts directly. Finally, note the small inconsistency where registry metadata omitted required binaries (curl, jq) — ensure those tools are available and review scripts locally before running them.

Like a lobster shell, security has layers — review code before you run it.

latestvk972ggh2xzv3a6zyy2g62jcvzn81bqpn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔍 Clawdis
EnvCAMINO_API_KEY
Primary envCAMINO_API_KEY

Comments