ClawHub
Back to skill

Security audit

Countries API

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward countries.dev lookup skill with disclosed third-party API use and no hidden code, persistence, or local access.

Install only if you are comfortable with the assistant using countries.dev for geography lookups. Avoid submitting private or third-party IP addresses, precise coordinates, or postal codes unless you intend to send them to that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation guidance is overly broad and encourages routing many generic geography-related requests to this external API even when the user did not explicitly ask for it. That can cause unnecessary third-party data disclosure, reduce user choice, and expand the situations where untrusted external content influences responses.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises IP geolocation without warning that an IP address will be sent to a third-party service, which is a privacy-sensitive operation because IPs can be personal data. Users may provide their own or someone else's IP without understanding the disclosure, creating avoidable privacy and compliance risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation encourages use of `/ip` and `/ip/{ip}` endpoints without warning that querying them sends a user's IP address or another person's IP address to a third-party service. IP addresses are personal data in many contexts, so a skill that silently forwards them can create privacy, consent, and compliance risks, especially when users ask 'where is this IP from' and may provide sensitive identifiers.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.