ClawHub
Back to skill

Security audit

custom-ipconfig

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it queries a public IP/location service and shows the current network's IP, approximate location, and ISP, with no persistence or executable installer behavior found.

Install only if you are comfortable with an external IP lookup service seeing the agent's outgoing public IP and returning approximate location/ISP details in chat. Be cautious using it on sensitive networks, VPN/proxy setups, or when you only wanted local network diagnostics rather than an internet-based public-IP lookup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad enough to match general networking or location-related requests, which can cause the skill to run when the user did not clearly consent to an external IP/geolocation lookup. In this skill’s context, accidental activation is meaningful because execution reveals the device’s public IP and related location data to a third-party service.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs the agent to automatically contact a third-party IP intelligence service to obtain public IP, ISP, and approximate geolocation without warning the user that this discloses metadata externally. This is dangerous because even though the service observes the caller’s IP implicitly, the skill normalizes silent sharing of sensitive network/location information and returns it to the conversation without explicit privacy consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.