IP Address Query - IP查询

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:40 AM UTC
• Version: 1.0.2

Overview

This skill appears to be a straightforward IP lookup integration, with the main caveat that it sends queried IPs and a Jisu API key to JisuAPI.

Install only if you are comfortable sending queried IP addresses to JisuAPI and storing a dedicated JISU_API_KEY in the environment. Prefer a restricted, quota-limited key, rotate it if request URLs may be logged, and avoid submitting sensitive internal/private IPs unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: ip.py:23

Finding

API Credential Exposed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: ip.py, lines 23–38
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

python

params = {"appkey": appkey}

ip = req.get("ip")
if not ip:
    return {
        "error": "missing_param",
        "message": "ip is required",
    }
params["ip"] = ip

try:
    resp = requests.get(IP_LOCATION_URL, params=params, timeout=10)

Technical Analysis

The API key obtained from the JISU_API_KEY environment variable is added to the params dictionary and passed to requests.get. This causes the credential to be encoded into the request URL as a query parameter.

HTTPS protects the URL while it is transmitted between the client and the HTTPS endpoint, but it does not prevent the complete URL from being recorded by local diagnostics, HTTP client instrumentation, forward proxies, API gateways, monitoring products, or server access logs. Consequently, systems and personnel with access to those records may gain access to the credential.

Attack Path

1. A legitimate user invokes the skill with JISU_API_KEY configured.
2. The script constructs a URL containing both appkey and ip query parameters.
3. A proxy, gateway, server, monitoring system, or diagnostic facility records the complete request URL.
4. An attacker or unauthorized operator obtains access to those records.
5. The attacker extracts the appkey value from the recorded query string.
6. The attacker reuses the credential to make unauthorized requests to JisuAPI until the key is revoked, expires, or reaches its quota.

Impact Assessment

Successful exploitation exposes the privileges associated with the JisuAPI key. An attacker could consume the account's API quota, issue requests billed or attributed to the legitimate account, and cause denial of service by exhausting request limits. The scope is limited to permissions granted to that API key; the ...[truncated 100 chars]

Remediation

View remediation

Remediation Suggestions

1. If JisuAPI supports it, transmit the credential in an HTTP authorization header rather than in the URL:

   python

   headers = {"Authorization": f"Bearer {appkey}"}
   params = {"ip": ip}
   resp = requests.get(
       IP_LOCATION_URL,
       headers=headers,
       params=params,
       timeout=10,
   )
   

2. If the provider requires appkey as a query parameter, confirm whether an authenticated POST body is supported and prefer that mechanism.
3. Where the provider offers no alternative, configure clients, proxies, gateways, observability tools, and server access logs to redact the appkey parameter.
4. Use a dedicated, least-privileged API key with restrictive quotas or endpoint permissions where supported.
5. Rotate the key periodically and immediately rotate it if URLs containing the key may have been logged.
6. Avoid logging prepared request URLs, exception objects containing request details, or verbose HTTP traces in production.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires both environment-secret access (JISU_API_KEY) and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow the runtime or reviewers to underestimate what the skill is capable of doing, increasing the risk of unintended secret exposure or unexpected network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description uses broad language like 'or similar IP attribution questions,' which leaves activation boundaries underspecified. Overbroad routing can cause the agent to invoke this networked, secret-using skill for loosely related prompts, unnecessarily exposing user-supplied data to a third-party API and increasing the chance of unintended execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code includes natural-language documentation entirely in Chinese and presents the skill as a Chinese-language API integration, with additional user-facing usage text in Chinese. The file does not offer any language or locale choice, which can violate language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill transmits user-supplied IP addresses and an API key to a third-party service over the network. Although this is expected for an IP lookup skill, it creates a real data exfiltration and third-party dependency risk: user queries may contain sensitive internal/private IPs, and the external provider receives both the lookup target and metadata associated with the request.

Content

Scanner excerpt · ip.py (reported line 14)May include surrounding context.

python

import requests


IP_LOCATION_URL = "https://api.jisuapi.com/ip/location"


def query_ip_location(appkey: str, req: dict):

Static analysis

No suspicious patterns detected.