Search for places using natural language with Camino AI's location intelligence API. Returns relevant results with coordinates, distances, and metadata. Use...
Security Analysis
high confidenceThe skill's requests and instructions are consistent with a location-query integration that calls Camino's API using a single API key; nothing in the included script or SKILL.md indicates hidden exfiltration or unrelated credential requests.
Name/description, required environment variable (CAMINO_API_KEY), and code (scripts/query.sh) all align: the skill simply calls https://api.getcamino.ai/query with the API key. One minor inconsistency: the registry metadata at the top lists no required binaries, while the SKILL.md metadata and the script both require curl and jq. Functionally the binaries are necessary and used by the script.
SKILL.md and scripts limit actions to building a URL-encoded query and calling Camino's API; the script validates JSON, checks for jq/curl, and sends the CAMINO_API_KEY in a request header. The instructions do tell the user to store the API key in ~/.claude/settings.json (a plaintext config), which is a usability/sensitivity note but not malicious. The skill does not instruct reading other unrelated files or transmitting data to unexpected endpoints.
This is instruction-only with an included shell script (no automatic install spec). SKILL.md suggests installing via npx (pulling from a GitHub repo) or clawhub; using npx installs remote code and has the usual supply-chain considerations. The repository is a GitHub URL (reasonable), and there are no opaque archive downloads or extract steps in the provided files.
Only CAMINO_API_KEY is required and is declared as the primary credential. No unrelated secrets or multiple credentials are requested. Reminder: storing the key in ~/.claude/settings.json or other plaintext configs can expose it if that file is shared or backed up.
The skill does not request always:true and does not modify other skills or system-wide settings in the provided files. Autonomous invocation is allowed by default (platform behavior) but the skill itself does not escalate privileges or persist beyond its normal files.
Guidance
This skill appears to do what it says: it builds a query and calls Camino's API using CAMINO_API_KEY. Before installing or using it, verify you trust api.getcamino.ai and the repository owner. Prefer giving it a limited-scope or trial API key (the SKILL.md documents a trial endpoint). Be cautious storing the API key in plaintext (~/.claude/settings.json); consider using a secret store or environment variable limited to the process. If you plan to run the npx install command, inspect the remote repo first (or clone it) rather than running arbitrary install scripts directly. Finally, note the small inconsistency where registry metadata omitted required binaries (curl, jq) — ensure those tools are available and review scripts locally before running them.
Latest Release
v0.2.0
- Added "curl" and "jq" as required system binaries in the skill metadata. - No other user-facing documentation or usage changes.
Popular Skills
Published by @James-southendsolutions on ClawHub
