Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward IP geolocation API helper with a mild privacy caveat around sending IP addresses to apipick.
Before installing, be aware that IP addresses you ask the agent to geolocate, including your current public IP when using the no-parameter mode, will be sent to apipick along with your apipick API key. Avoid submitting sensitive, customer, internal, or unauthorized IP data.
The README encourages users to submit IP addresses, including their own, to a third-party API but does not clearly disclose the privacy implications of transmitting this data off-platform. IP addresses can be personal data in many contexts, and the omission may cause users or downstream agents to send sensitive network identifiers without informed consent or policy review.
The skill explicitly tells users they can omit the IP parameter to look up the caller's own IP, but it does not warn that this causes the platform or user IP to be sent to a third-party service. That creates a privacy and transparency issue because users may unknowingly disclose network-identifying information, and IP addresses can be personal data in some jurisdictions.
The documentation explicitly states that omitting the ip parameter looks up the caller's own IP, but it does not warn that this transmits the user's public IP to a third-party service. That can create an unexpected privacy disclosure, especially if an agent invokes the endpoint without clear user awareness or consent.
No suspicious patterns detected.
