ip-lookup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ip-lookup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Purpose
What it does
Notes
Bash example (uses curl + jq):
# Basic usage: IP passed as first arg
IP=${1:-8.8.8.8}
# Query 4 sources
A=$(curl -s "https://ipinfo.io/${IP}/json")
B=$(curl -s "http://ip-api.com/json/${IP}?fields=status,country,regionName,city,lat,lon,org,query")
C=$(curl -s "https://geolocation-db.com/json/${IP}&position=true")
D=$(curl -s "https://api.db-ip.com/v2/free/${IP}" )
# Output best-match heuristics should be implemented in script
echo "One-line summary:"
jq -n '{ip:env.IP,sourceA:A,sourceB:B,sourceC:C,sourceD:D}' --argjson A "$A" --argjson B "$B" --argjson C "$C" --argjson D "$D"Node.js example (recommended):
// ip_lookup.js
async function fetchJson(url, timeout = 8000){
const controller = new AbortController();
const id = setTimeout(()=>controller.abort(), timeout);
try { const res = await fetch(url, {signal: controller.signal}); clearTimeout(id); if(!res.ok) throw new Error(res.statusText); return await res.json(); } catch(e){ clearTimeout(id); throw e; }
}
async function ipLookup(ip){
const sources = {
ipinfo: `https://ipinfo.io/${ip}/json`,
ipapi: `http://ip-api.com/json/${ip}?fields=status,country,regionName,city,lat,lon,org,query`,
geodb: `https://geolocation-db.com/json/${ip}&position=true`,
dbip: `https://api.db-ip.com/v2/free/${ip}`
};
const results = {};
for(const [k,u] of Object.entries(sources)){
try{ results[k] = await fetchJson(u); } catch(e){ results[k] = {error: e.message}; }
}
// Normalise and pick best match (simple majority on country+city)
const votes = {};
for(const r of Object.values(results)){
if(!r || r.error) continue;
const country = r.country || r.country_name || r.countryCode || null;
const city = r.city || r.city_name || null;
const key = `${country||'?'}/${city||'?'}`;
votes[key] = (votes[key]||0)+1;
}
const best = Object.entries(votes).sort((a,b)=>b[1]-a[1])[0];
return {best: best?best[0]:null,score: best?best[1]:0,results};
}
// Usage: node ip_lookup.js 8.8.8.8Agent prompt ------------
"Use the ip-lookup skill to query at least four public IP information providers for {ip}. Return a short JSON summary: best_match (country/city), score, and per-source details (country, region, city, lat, lon, org). Respect rate limits and fall back to alternate endpoints on errors."
"When creating a new skill, follow SKILL_TEMPLATE.md format and include Node.js and Bash examples."
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.