Security audit
Security checks for vulnerabilities and agentic risk
This is a small IP geolocation helper whose network lookups are disclosed and aligned with its stated purpose, with privacy considerations for public-IP queries.
Install only if you are comfortable sending queried IP addresses, and your machine's public IP when no argument is supplied, to third-party geolocation services. Use an explicit IP argument if you want to avoid the automatic public-IP discovery request.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
if [ -z "$IP" ]; then
# 获取本机公网 IP
IP=$(curl -fsSL --max-time 15 "https://api.ip.sb/geoip" 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('ip',''))" 2>/dev/null) || true
[ -z "$IP" ] && { echo "获取本机 IP 失败，请检查网络，或直接指定: ip-lookup 8.8.8.8" >&2; exit 1; }
LABEL="本机公网 IP"
else
The skill advertises shell-based behavior and installation of command-line tools but does not declare any explicit tool scope or allowed tools. That makes the skill's execution capabilities less transparent to the user or runtime policy layer, increasing the risk of unintended command execution or overly broad tool access.
The skill supports querying the current machine's public IP via third-party geolocation services, but the description does not clearly warn users that this sends network-derived data to external providers. This can expose user or organization IP information and related metadata to outside services without informed consent, which is especially sensitive in enterprise or privacy-conscious environments.
This request transmits data to an external service to discover the caller's public IP, which is sensitive network metadata. In this skill's context, external transmission is expected functionality, but it still poses a real privacy concern because it happens automatically when no IP argument is supplied.
if [ -z "$IP" ]; then
# 获取本机公网 IP
IP=$(curl -fsSL --max-time 15 "https://api.ip.sb/geoip" 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('ip',''))" 2>/dev/null) || true
[ -z "$IP" ] && { echo "获取本机 IP 失败，请检查网络，或直接指定: ip-lookup 8.8.8.8" >&2; exit 1; }
LABEL="本机公网 IP"
else
The script sends either the user's local public IP or a user-supplied IP address to third-party services (api.ip.sb and ipwho.is) without an explicit runtime warning or consent prompt. This creates a privacy risk because IPs can be personal or sensitive metadata, and the skill context specifically performs network lookups against external providers.
The script transmits the queried IP to external lookup providers, exposing potentially sensitive user-supplied data to third parties. This is not hidden exfiltration beyond the tool's purpose, but the absence of an explicit privacy notice and provider disclosure makes it a valid privacy/security concern.
LABEL="IP $IP"
fi
DATA=$(curl -fsSL --max-time 15 "https://api.ip.sb/geoip/$IP" 2>/dev/null) || DATA=$(curl -fsSL --max-time 15 "https://ipwho.is/$IP" 2>/dev/null) || { echo "查询失败，请检查网络" >&2; exit 1; }
if [ "$JSON" = 1 ]; then
echo "$DATA"
Natural-language strings such as the description, usage notes, and error messages are all presented in Chinese with no alternative language or user-selectable locale. This creates a language policy issue if skills are expected not to force a specific language without explicit opt-in or documented regional scope.