Security audit
Security checks for vulnerabilities and agentic risk
This skill is low-risk because it only prints static reference text, though its GeoIP content is generic and not very useful.
Install only if you want a very generic, offline reference stub. Do not rely on it for actual GeoIP lookup, IP geolocation decisions, security investigations, compliance work, or operational guidance without independent documentation.
The skill is named and described as 'geoip' but only exposes generic reference-documentation commands, with no actual GeoIP lookup or IP-related functionality. This mismatch can mislead an agent into invoking the skill in the wrong context, causing incorrect task routing, false trust in capabilities, or accidental substitution of unrelated documentation for expected network/IP handling.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Prerequisites
- Basic understanding of devtools concepts
- Required tools and access credentials
- System meeting minimum requirements
## Installation
The skill description and trigger scope are so vague that an orchestrating agent cannot reliably determine when it should be invoked. Overbroad or ambiguous scope increases the chance of inappropriate activation, which can confuse workflows, produce irrelevant output, and mask capability gaps behind generic reference text.
The script is presented as a 'geoip' tool but implements only static boilerplate help text and generic documentation. This mismatch is dangerous because it can mislead users or downstream agents into trusting the skill for GeoIP-related tasks it cannot perform, causing incorrect security, operational, or compliance decisions.
The header and help output explicitly describe the script as a GeoIP reference tool, but the content is generic and not substantively related to GeoIP. In an agent skill ecosystem, deceptive or inaccurate documentation increases the risk of misuse, bad automation choices, and misplaced trust in security-sensitive workflows.
No suspicious patterns detected.