Ipdataco

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.0.2

Overview

This skill is a disclosed Membrane-based Ipdata.co integration with no packaged executable code, but users should understand that requests and authentication flow through Membrane and Ipdata.co.

Install only if you trust Membrane and are comfortable with a global CLI install plus Membrane handling the authenticated Ipdata.co connection. Prefer discovered Membrane actions, and use raw proxy requests only when you know exactly what endpoint, parameters, and HTTP method will be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly encourages direct proxy requests to an external API without requiring an explicit user-facing confirmation that data will be transmitted off-platform. In an agent setting, this can cause sensitive IPs, query parameters, or user-provided data to be sent to a third-party service unexpectedly, creating privacy and data-handling risk.

VirusTotal

63/63 vendors flagged this skill as clean.