ClawHub
Back to skill

Security audit

IP Intelligence Fusion

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed IP intelligence/reporting tool whose network lookups, optional credential use, and local report writes match its stated purpose.

Install only if you are comfortable sending the IPs you investigate to the listed third-party intelligence providers. Review your environment first, because existing API keys may be used automatically; use provider include/exclude options if you want to avoid a provider or credential. Avoid raw payload output unless you need it, since reports are written locally and may contain detailed provider responses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to use environment credentials, read bundled/reference files, write reports, and perform network lookups, but the skill metadata declares no permissions. That mismatch creates a governance and least-privilege problem: the agent may access sensitive capabilities without explicit user-visible declaration or review, increasing the chance of unintended secret use, data egress, or filesystem/network activity.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def lookup_ipinfo(ip: str, timeout: float) -> Dict[str, Any]:
    token = os.environ["IPINFO_TOKEN"]
    raw = request_json(with_query(f"https://api.ipinfo.io/lite/{urllib.parse.quote(ip)}", {"token": token}), timeout)
    privacy = raw.get("privacy") if isinstance(raw.get("privacy"), Mapping) else {}
    asn_obj = raw.get("asn") if isinstance(raw.get("asn"), Mapping) else {}
Confidence
95% confidence
Finding
os.environ["IPINFO_TOKEN"]

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def lookup_ipqs(ip: str, timeout: float) -> Dict[str, Any]:
    key = urllib.parse.quote(os.environ["IPQS_API_KEY"], safe="")
    url = with_query(f"https://www.ipqualityscore.com/api/json/ip/{key}/{urllib.parse.quote(ip)}", {
        "strictness": 1, "allow_public_access_points": "true", "fast": "false",
        "lighter_penalties": "true",
Confidence
98% confidence
Finding
os.environ["IPQS_API_KEY"]

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def lookup_ipdata(ip: str, timeout: float) -> Dict[str, Any]:
    raw = request_json(with_query(f"https://api.ipdata.co/{urllib.parse.quote(ip)}", {"api-key": os.environ["IPDATA_API_KEY"]}), timeout)
    if raw.get("message") and not raw.get("ip"):
        raise LookupError(text_value(raw.get("message")) or "ipdata lookup failed")
    threat = raw.get("threat") if isinstance(raw.get("threat"), Mapping) else {}
Confidence
96% confidence
Finding
os.environ["IPDATA_API_KEY"]

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def lookup_scamalytics(ip: str, timeout: float) -> Dict[str, Any]:
    base = os.environ["SCAMALYTICS_API_URL"].strip()
    key = os.environ["SCAMALYTICS_API_KEY"]
    if not base.lower().startswith("https://"):
        raise LookupError("SCAMALYTICS_API_URL must use HTTPS")
    if "{ip}" in base or "{key}" in base:
Confidence
95% confidence
Finding
os.environ["SCAMALYTICS_API_KEY"]

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_ip_intelligence.py:15