ip lookup ( get ip )

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:24 AM UTC
• Version: 1.0.2

Overview

This skill does what it says, but users should understand that IP and approximate location lookups contact third-party web services.

Install only if you are comfortable with the agent contacting public IP and geolocation providers such as ipip.net, icanhazip.com, ifconfig.me, api.ipify.org, and ipinfo.io. Prefer asking explicitly for IP lookup, and consider hardening the commands to use HTTPS-only endpoints, timeouts, response validation, and an explicit consent step before geolocation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Unvalidated Remote Response Used in Shell Command Construction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Shell argument injection through unquoted command substitution
Risk Level: Medium

Vulnerable Code:

bash

curl -s https://ipinfo.io/$(curl -s https://api.ipify.org)/json

Technical Analysis

The output returned by https://api.ipify.org is inserted into the outer curl command through an unquoted command substitution. Because the substitution is not enclosed in double quotes, the shell can apply word splitting and pathname expansion to the remote response.

If the API response is compromised or modified, whitespace-delimited content can introduce additional arguments to the outer curl process. In particular, attacker-supplied strings resembling curl options could change request behavior or cause response data to be written to a path accessible to the current user.

Exploitation requires control over the API response or a compromise of the HTTPS endpoint, its infrastructure, DNS resolution combined with a trusted certificate, or the local TLS trust environment. This reduces exploitability but does not remove the unsafe shell construction.

Attack Path

1. A user or agent follows the full geolocation workflow in SKILL.md.
2. The shell requests the public IP from https://api.ipify.org.
3. An attacker controlling the service response returns whitespace-separated content rather than a valid IP address.
4. The unquoted command substitution undergoes shell word splitting.
5. Portions of the response are interpreted as additional arguments to the outer curl command.
6. The injected curl arguments alter network behavior or write downloaded content to a location writable by the invoking user.

Impact Assessment

Successful exploitation executes curl with attacker-influenced arguments under the privileges of the user running the Skill. It does not directly provide privilege escalation or arbitrary shell command ...[truncated 354 chars]

Remediation

View remediation

Remediation Suggestions

Retrieve the address separately, validate it as an IPv4 or IPv6 address, and pass it as a quoted argument:

bash

IP="$(curl --fail --silent --show-error --max-time 5 https://api.ipify.org)" || exit 1

python3 -c 'import ipaddress, sys; ipaddress.ip_address(sys.argv[1])' "$IP" || {
    printf '%s\n' "Invalid IP response" >&2
    exit 1
}

curl --fail --silent --show-error --max-time 5 \
    "https://ipinfo.io/${IP}/json"

Additional hardening should include:

• Apply connection and total request timeouts.
• Reject responses containing whitespace, control characters, or unexpected lengths.
• Use --proto '=https' to restrict curl to HTTPS.
• Prefer an API that returns structured JSON and validate its schema before using any field.
• Avoid constructing shell commands directly from remote response data.

T09 · Insecure Skill Coding Practices

Note

• Location: get_ip.sh:6

Finding

Public IP Lookups Use Plaintext HTTP Endpoints

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-53; get_ip.sh, lines 6-11
Vulnerability Type: Missing transport authentication and response integrity
Risk Level: Low

Vulnerable Code in SKILL.md:

bash

curl -s myip.ipip.net

bash

curl -s icanhazip.com

bash

curl -s ifconfig.me

Vulnerable Code in get_ip.sh:

bash

URLS=(
  myip.ipip.net
  ifconfig.me
  icanhazip.com
  https://api.ipify.org
)

Technical Analysis

The endpoints without an explicit scheme are resolved by curl as HTTP URLs. Plaintext HTTP provides neither server authentication nor transport integrity. An attacker positioned on the network path can observe, redirect, or replace the response.

In get_ip.sh, responses from these services are accepted without validating that they contain a syntactically valid IP address or an expected response format. A modified response can therefore be displayed as authoritative IP information or sent to ipinfo.io as part of a subsequent geolocation request.

This network access is necessary for the declared public-IP lookup functionality, but plaintext transport is not necessary because HTTPS alternatives are available. The implementation consequently uses weaker privileges and trust boundaries than required.

Attack Path

1. A user invokes get_ip.sh or follows one of the documented plaintext lookup commands.
2. Curl sends an unauthenticated HTTP request to the selected provider.
3. An attacker with an on-path position intercepts the request or response.
4. The attacker supplies a fabricated IP address, location string, or other response content.
5. The Skill displays the modified information or uses it as the lookup value sent to the HTTPS geolocation service.
6. The user or calling agent makes decisions based on false public-IP or location information.

Impact Assessment

The primary impact is loss of response int ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

Replace every implicit HTTP endpoint with an explicit HTTPS URL:

bash

URLS=(
  "https://myip.ipip.net"
  "https://ifconfig.me"
  "https://icanhazip.com"
  "https://api.ipify.org"
)

Update the corresponding commands in SKILL.md as well. Harden curl invocation and validate every response:

bash

IP="$(curl --proto '=https' --fail --silent --show-error \
    --connect-timeout 3 --max-time 5 \
    'https://api.ipify.org')" || exit 1

Recommended additional controls:

• Confirm that each provider supports HTTPS before retaining it.
• Validate plain-IP responses with a standard IP-address parser.
• Validate structured geolocation responses against the expected JSON schema.
• Set response-size limits to avoid processing unexpectedly large responses.
• Do not silently accept redirects to HTTP; restrict redirects to HTTPS.
• Clearly identify the external service used and treat all returned location data as untrusted informational data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared purpose and the actual code behavior. The description claims the skill fetches and displays public IP address and geolocation information, but the code never performs any network requests, IP lookup, geolocation resolution, or output formatting related to IP data. Instead, it operates entirely on local files: reading SKILL.md, parsing YAML frontmatter, validating metadata, traversing directories, and creating a zip-based .skill package. This is a materially different primary purpose and includes undeclared capabilities related to local filesystem access and packaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends the user's public IP to multiple third-party services (myip.ipip.net, icanhazip.com, api.ipify.org, ifconfig.me, ipinfo.io) without warning or consent. Public IP and derived geolocation are privacy-sensitive metadata, and sharing them with external providers can disclose approximate location, ISP, and usage patterns to parties the user did not intend to contact.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · get_ip.sh (reported line 40)May include surrounding context.

sh

fi
    
    # Try to get geolocation
    GEO=$(curl -s "https://ipinfo.io/$IP/json" 2>/dev/null)
    if [ $? -eq 0 ] && [ -n "$GEO" ]; then
        echo "$IP"
        echo "$GEO" | python3 -c "

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run shell commands (curl) but does not declare any explicit tool scope or permissions. That creates an authorization/least-privilege gap: a reviewer or runtime may not realize the skill needs network-capable shell access, increasing the chance of unintended execution or policy bypass.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad and include ambiguous requests such as 'Where am I?', 'Get location', and 'Locate me'. In an agent setting, that can cause unintended activation and external requests that expose the user's public IP or infer location when the user did not clearly consent to a network lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends requests to multiple external IP-discovery services, which necessarily discloses the user's public IP and related request metadata to third parties. In the context of a skill that retrieves public IP information this behavior is functionally expected, but it is still a real privacy issue because there is no explicit disclosure or consent beyond a generic status message.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The geolocation step transmits the discovered IP address to ipinfo.io, creating an additional disclosure to a separate third party. This increases privacy exposure because the script first learns the user's IP from one service and then shares that same identifier with another service without explicit notice or user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.