Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it checks the machine's public IP by calling known external IP lookup services, with no evidence of hidden persistence or unrelated data access.
Install this only where external IP lookup is acceptable. Running it will contact third-party services that can observe your public IP, request timing, and normal HTTP metadata; avoid using it in restricted or privacy-sensitive environments unless that disclosure is allowed.
The skill performs outbound network requests to multiple third-party IP-discovery services, but the manifest does not declare any tool scope or permissions reflecting that network capability. This weakens reviewability and consent because a caller may not realize the skill will contact external services and disclose the host's network identifier.
The skill description omits a warning that checking a public IP necessarily sends requests to third-party services and reveals the machine's public network identifier to those providers. In privacy-sensitive or restricted environments, this can create unexpected data exposure and policy violations even if the functionality is otherwise legitimate.
This skill sends outbound requests to multiple third-party IP-discovery services, which necessarily disclose the host's public IP address and related metadata such as request timing, user agent, and possibly network-identifying information. In the context of an agent skill, this can leak infrastructure details to external parties without explicit user consent or disclosure, which is a real privacy and operational security concern even though determining the public IP is the stated purpose of the skill.
No suspicious patterns detected.
