ip-api
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
ip-api.comto retrieve geolocation data. This is a well-known service used for IP lookups. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API, which represents a potential surface for indirect prompt injection if the source were compromised.
- Ingestion points: The JSON response fetched from
http://ip-api.com/json/inip-query.jsandproxy-query.js. - Boundary markers: The scripts do not use explicit delimiters or safety instructions when outputting the retrieved data to the console/agent context.
- Capability inventory: The skill's scripts are limited to network communication and console logging; they do not contain file system write operations, command execution (
eval,exec), or persistence mechanisms. - Sanitization: Data is parsed as JSON, ensuring structural integrity, but the string values within the JSON (such as city or ISP names) are not sanitized for potential instructions before being displayed.
Audit Metadata