ClawHub
Back to skill

Security audit

Camino Places.Bak

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it sends place or address lookups to the Camino API and returns location results, with some normal setup and privacy cautions to consider.

Before installing, prefer a pinned or reviewed ClawHub version rather than mutable @latest or an unpinned GitHub URL. Treat place searches and addresses as data sent to Camino, and store CAMINO_API_KEY only in agent settings you trust and control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Installation Sources Permit Supply-Chain Code Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-24
Vulnerability Type: Unpinned third-party dependencies and mutable installation sources
Risk Level: Medium

bash
# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill places

Via clawhub:

bash
npx clawhub@latest install places
# or: pnpm dlx clawhub@latest install places
# or: bunx clawhub@latest install places

Technical Analysis

The documented installation commands obtain executable tooling and skill content from mutable external sources. The GitHub repository URL is not pinned to an immutable commit or signed release, while the ClawHub commands explicitly select the mutable latest package version.

Package runners such as npx, pnpm dlx, and bunx download and execute package code in the installing user's environment. Consequently, the code executed by these commands can differ from the version reviewed during this audit. No evidence establishes that the current upstream packages are malicious; the vulnerability is the absence of version pinning and integrity verification.

Attack Path

  1. An attacker compromises the upstream repository, package registry account, maintainer credentials, or package publication process.
  2. The attacker modifies the repository's default branch or publishes a malicious package version that becomes latest.
  3. A user follows one of the documented installation commands.
  4. The package runner retrieves the altered dependency or installer without validating it against an audit-approved commit or integrity digest.
  5. Attacker-controlled installation or lifecycle code executes with the privileges of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. ...[truncated 434 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the installation tool to a reviewed exact version instead of using @latest, for example clawhub@X.Y.Z.
  • Pin the GitHub source to an immutable, reviewed commit SHA or cryptographically signed release tag rather than the mutable default branch.
  • Publish and verify integrity hashes or signatures for both the installer and skill artifact before execution.
  • Use package-manager lockfiles where applicable and enforce integrity metadata during automated installation.
  • Document a verification procedure that checks the expected repository commit, package digest, and publisher identity.
  • Review lifecycle scripts and downloaded artifacts before executing installation commands, particularly in privileged or CI environments.
  • Avoid running package installers with administrative privileges and use a sandboxed or otherwise least-privileged environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Instructing users to modify ~/.claude/settings.json involves access to an agent configuration directory that may contain sensitive settings, tokens, or broader environment configuration. In a tool-using assistant context, normalizing writes to this path increases the risk of credential exposure, unauthorized config changes, or accidental persistence of secrets in an unsafe location.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json
{

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill demonstrates shell-based installation and usage patterns but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, this can cause overbroad execution capability or ambiguous trust boundaries, increasing the chance that shell commands are run when the user did not intend that level of access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx skills add https://github.com/barneyjm/camino-skills without pinning a version, tag, or commit means the installed code can change over time. This creates a supply-chain risk where a compromised upstream package or repository update could introduce malicious behavior into the agent skill installation flow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx skills add https://github.com/barneyjm/camino-skills --skill places still pulls code from an unpinned remote source. Even though it targets one skill, the fetched installer logic or repository contents may change, enabling arbitrary changes after the documentation is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx clawhub@latest install places explicitly tracks the latest version, which is mutable and may introduce unreviewed code at install time. In agent ecosystems, unpinned bootstrap tools are a common supply-chain entry point because they run code before the user can inspect the installed skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trial signup example sends the user's email address to an external service but does not clearly disclose privacy implications, retention expectations, or that personal data is being transmitted. This can lead users or agents to share personally identifiable information without informed consent or appropriate minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example transmits user-supplied email data to an external endpoint. While expected for obtaining a trial API key, it is still a real data egress event and is more sensitive because the skill documentation frames it as a quick setup step without emphasizing that personal data leaves the local environment.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Instant Trial (no signup required): Get a temporary API key with 25 calls:

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}' \
  https://api.getcamino.ai/trial/start

Returns: {"api_key": "camino-xxx...", "calls_remaining": 25, ...}

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code performs an outbound POST request carrying raw user input and an API credential to an external service. In the context of a place lookup skill, the network call is expected, but it still represents a true external data transmission issue because potentially sensitive search terms and addresses leave the local environment and are not surfaced to the user with any caution or policy guardrails.

Content

Scanner excerpt · scripts/places.sh (reported line 55)May include surrounding context.

sh
fi

# Make API request
curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends user-supplied location queries and address components directly to a third-party service without any explicit privacy notice, consent step, or warning at runtime. Because place searches may contain sensitive personal location data such as home addresses or points of interest, this creates a real data exposure risk even though the transmission appears intentional for the skill's functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded external endpoint confirms that all lookups are sent to a remote Camino API rather than being processed locally. While this aligns with the stated skill purpose, it increases privacy and supply-chain exposure because sensitive location data depends on the security and trustworthiness of an external service.

Content

Scanner excerpt · scripts/places.sh (reported line 60)May include surrounding context.

sh
-H "Content-Type: application/json" \
    -H "X-Client: claude-code-skill" \
    -d "$INPUT" \
    "https://api.getcamino.ai/search" | jq .

Static analysis

No suspicious patterns detected.