Security audit

Get IP Geo Location

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward IP geolocation API helper with a mild privacy caveat around sending IP addresses to apipick.

Before installing, be aware that IP addresses you ask the agent to geolocate, including your current public IP when using the no-parameter mode, will be sent to apipick along with your apipick API key. Avoid submitting sensitive, customer, internal, or unauthorized IP data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README encourages users to submit IP addresses, including their own, to a third-party API but does not clearly disclose the privacy implications of transmitting this data off-platform. IP addresses can be personal data in many contexts, and the omission may cause users or downstream agents to send sensitive network identifiers without informed consent or policy review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells users they can omit the IP parameter to look up the caller's own IP, but it does not warn that this causes the platform or user IP to be sent to a third-party service. That creates a privacy and transparency issue because users may unknowingly disclose network-identifying information, and IP addresses can be personal data in some jurisdictions.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The documentation explicitly states that omitting the `ip` parameter looks up the caller's own IP, but it does not warn that this transmits the user's public IP to a third-party service. That can create an unexpected privacy disclosure, especially if an agent invokes the endpoint without clear user awareness or consent.

Static analysis

No suspicious patterns detected.