get-public-ip

• Risk level: Low
• Analyzed: May 8, 2026, 2:17 AM
• Findings: 1
• Version: 1.0.0

Overview

This skill appears to be a simple public-IP checker that uses fixed public web services and local curl/PowerShell commands, with no credentials, installation, or persistence requested.

This looks safe for a basic public-IP check. Before installing, be comfortable with the agent making outbound requests to the listed IP lookup services and using curl or PowerShell locally when you ask for your public IP.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

When invoked, the agent may run a local network command and contact public IP lookup services, which will see the user's public IP address and normal request metadata.

Why it was flagged

The skill authorizes local command use and outbound requests to fixed third-party IP lookup services. This is expected for the stated public-IP-checking purpose, but it is still a behavior users should be aware of.

Skill content

当收到获取 IP 请求时，用 PowerShell 执行以下逻辑（Windows 直接调用，macOS/Linux 用 curl）... 依次尝试：1. `https://ip.sb` ... 4. `https://httpbin.org/ip`

Recommendation

Use the skill only when you intend to check your public IP, and avoid it if you do not want those listed services to receive a request from your network.