ClawHub
Back to skill

Security audit

IP Threat Check

Security checks for vulnerabilities and agentic risk

Overview

The skill does IP reputation checks as advertised, but it always sends queried IPs to an external HTTP service, including bulk lists, with weak user control over that disclosure.

Review before installing if you handle sensitive investigations, customer infrastructure, or internal IP lists. Use it only when you are comfortable disclosing queried IPs to ip-api.com and AbuseIPDB, and be especially cautious with bulk files because every listed address is submitted externally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ip_threat.py:16
Finding

Cleartext Transmission of Queried IP Addresses and Threat Intelligence

Content
View full analysis

Vulnerability Details

File Location: scripts/ip_threat.py, lines 16–23
Vulnerability Type: Cleartext transmission of potentially sensitive lookup data
Risk Level: Medium

Vulnerable Code:

python
url = f"http://ip-api.com/json/{ip}?fields=status,country,countryCode,region,regionName,city,isp,org,as,asname,query"

req = urllib.request.Request(url)
req.add_header('User-Agent', 'OpenClaw-IP-Threat-Check/1.0')

with urllib.request.urlopen(req, timeout=10) as response:
    data = json.loads(response.read().decode())

Technical Analysis

The Skill sends every IP address submitted to the ip-api.com data source over unencrypted HTTP. This request occurs for the info action and is also performed unconditionally by check_ip_threat, including bulk checks.

Sending a queried IP to an external intelligence provider is necessary for the declared functionality. However, using cleartext HTTP is not a minimum functional requirement. HTTP provides neither transport confidentiality nor server authentication and response integrity. A network observer can identify which addresses are under investigation, while an active on-path attacker can intercept or modify the returned geolocation, ISP, organization, and ASN data.

The response is decoded and incorporated into the Skill's JSON output without any cryptographic authenticity protection. The project does use HTTPS for AbuseIPDB and sends the API key only to that HTTPS endpoint; no evidence was found that credentials are sent to ip-api.com.

Attack Path

  1. A user invokes info, check, or bulk with one or more IP addresses.
  2. The Skill constructs a URL containing each queried address and sends it to ip-api.com using cleartext HTTP.
  3. An attacker able to observe or alter network traffic intercepts the request.
  4. A passive attacker records the investigated IP addresses. An active attacker instead returns forged JSON with a successful status ...[truncated 893 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the cleartext endpoint with an HTTPS-capable geolocation or threat-intelligence endpoint.
  2. Retain standard TLS certificate and hostname validation; do not disable verification or silently fall back to HTTP.
  3. Fail closed with a clear error if a secure connection cannot be established.
  4. Validate IP input using Python's ipaddress module before constructing requests, and construct query parameters with a URL-encoding API rather than direct string interpolation.
  5. Validate the response schema and expected field types before using returned intelligence.
  6. Document that queried addresses are disclosed to external providers, particularly in bulk mode, and obtain user approval where investigation targets are sensitive.
  7. Consider making each external source explicitly selectable rather than always querying the basic-information service during a threat check.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description, headings, and usage notes are written in Chinese throughout the README, with no indication that this is optional or that other language support is available. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is justified or optional.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares runtime requirements including environment-variable access and implies file and network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: an agent or reviewer cannot reliably constrain what the skill may access, increasing the risk of unintended data exposure, especially for API keys and local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends user-supplied IP addresses to third-party services, including ip-api.com and potentially AbuseIPDB, without any explicit consent, warning, or privacy notice. Even though this matches the feature's purpose, IPs can be sensitive operational data, and silent transmission may expose internal investigation targets or customer infrastructure to external parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ip_threat.py (reported line 45)May include surrounding context.

python
def get_abuseipdb_info(ip: str, api_key: str, days: int = 30) -> dict:
    """Get IP threat info from AbuseIPDB"""
    try:
        url = f"https://api.abuseipdb.com/api/v2/check?ipAddress={ip}&maxAgeInDays={days}"
        
        req = urllib.request.Request(url)
        req.add_header('Key', api_key)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Bulk mode amplifies the privacy and data-exposure risk by transmitting every IP listed in a file to external services without warning or confirmation. If the file contains sensitive internal, customer, or investigative IPs, this can result in large-scale unintended disclosure to third parties.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest says the skill checks IP threat intelligence by querying multiple sources for reputation, geolocation, and threat scores. While external lookups are expected, directly reading a credential from the process environment introduces secret-access capability that is not stated in the skill purpose and is not necessary for the basic IP lookup path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.