ClawHub
Back to skill

Security audit

Camino Places.Bak

Security checks across malware telemetry and agentic risk

Overview

This is a purpose-aligned place lookup skill that sends user-entered location data to Camino’s API, with privacy considerations users should understand.

Install only if you are comfortable sending place searches, addresses, postal codes, and optional photo lookup parameters to Camino’s external API. Avoid submitting sensitive home, customer, or operational locations unless Camino’s privacy and retention terms meet your needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill sends user-supplied location queries, addresses, and possibly photo-related search parameters to a third-party API, yet the documentation does not clearly warn users about that data sharing. Because location and address data can be sensitive personal information, omission of a privacy notice can cause unintentional disclosure to an external service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.