Show My IP

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:45 AM UTC
• Version:
  1.0.0

Overview

This skill does what it says: it runs a small script to show the host's public IP address.

Install only if you are comfortable with the agent running a small shell script that contacts ifconfig.me and exposes your host's public IP address to that service. There is no artifact-backed evidence of credential access, persistence, or unrelated data collection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes a shell script to query an external service but declares no permissions, creating a mismatch between documented behavior and the access it requires. This is dangerous because it enables network egress and shell execution without explicit user or platform awareness, which can expose sensitive infrastructure details such as the host's public IP and weaken permission-based controls.

VirusTotal

66/66 vendors flagged this skill as clean.