Get My Ip

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  0.1.0

Overview

This skill simply fetches the machine's public IP address from ifconfig.me when asked, with no persistence, credential use, or local data access.

Install this only if you are comfortable with ifconfig.me seeing your public IP address and ordinary request metadata whenever you ask the skill to perform the lookup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends a request to a third-party service (`ifconfig.me`) that necessarily reveals the machine's public IP and related request metadata to that external operator, but it does not clearly warn about that disclosure or obtain explicit consent. While the behavior is consistent with the skill's purpose, the lack of an explicit privacy warning makes this a real information-disclosure issue, especially in sensitive or enterprise environments.

VirusTotal

66/66 vendors flagged this skill as clean.