ClawHub
Back to skill

Security audit

Ip Advisor

Security checks for vulnerabilities and agentic risk

Overview

This IP utility is mostly coherent and user-invoked, but users should know its public-IP command contacts an AWS endpoint and its local command reveals local network interface details.

Install only if you are comfortable with a user-invoked command showing local interface addresses and another user-invoked command contacting Amazon's checkip service to learn the machine's public IP. Avoid using local or public in sensitive network environments unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose is IP/subnet analysis, but the skill behavior appears to include local interface enumeration and external network access to obtain the public IP, which are materially different capabilities. This mismatch is dangerous because users may invoke a seemingly harmless planning tool without realizing it can inspect local network state or contact external services, enabling unexpected data exposure and trust-boundary violations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill exposes shell-backed commands but does not declare any tool scope or allowed-tools boundary, leaving the execution surface under-specified. In practice this can permit broader-than-expected shell access and makes it harder for reviewers or runtime policy to constrain what the skill is allowed to execute.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/script.sh (reported line 9)May include surrounding context.

sh
DATA_DIR="$HOME/.local/share/ip-advisor"
mkdir -p "$DATA_DIR"

#
#
#
#

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill inspects local network interfaces using ip -br addr or ifconfig, which exposes host network configuration unrelated to basic IP/CIDR calculation. In an agent setting, collecting local interface data can reveal sensitive internal addressing and environment details without a clear need tied to the stated skill purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is described as an IP/subnet planning utility, but it also performs an outbound request to Amazon's checkip service to discover the host's public IP. This leaks environment metadata to a third party and extends the skill's behavior beyond its stated purpose, which is risky in agent or automation contexts where network egress may be unexpected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script makes a silent external network call via curl -s https://checkip.amazonaws.com with no user-facing warning, consent, or disclosure. Even though the destination is benign, undisclosed outbound requests are dangerous because they leak execution context and can violate privacy, policy, or sandbox expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.