ipjudge@r1
CAUTION· install onlyPublisher claims: "Enables AI agents to judge the network exit of the requesting machine or any IP address — residential vs datacenter, purity score, risk-list hits — plus whether a region is in the official support lists for ChatGPT, Claude, Gemini and Meta Muse, and the live status of major services." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso ipjudge.org, netflix.com, youtube.com, tiktok.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is ipjudge@r1 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
run IPJUDGE_TEST_SITE="http://localhost:$PORT/s/good" https_proxy="http://alice:[email protected]:$PORT/p?token=QUERYSECRET"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.printf '{"env":{"HTTPS_PROXY":"http://zed:[email protected]:1"},"apiKeyHelper":"sk-ant-LEAKME"}\n' > "$SANDBOX/.claude/settings.json"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.# curl -sL ipjudge.org/cc | bash 中文Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.trap 'kill $SRV 2>/dev/null; rm -rf "$TMP"' EXITFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CXENV="${CODEX_HOME:-$HOME/.codex}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.…**Read-only.** Do not edit shell profiles, `~/.claude/settings.json`, `~/.codex/.env`, environment variables or system proxy settings. If a fix is plausible, show t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.# curl -sL ipjudge.org/cc | bash 中文Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.# 启动时读 $CODEX_HOME/.env(默认 ~/.codex/.env),覆盖终端里同名变量;HTTP 客户端冇开 SOCKS。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.# curl -sL ipjudge.org/en/cc | bash EnglishFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.# curl -sL ipjudge.org/en/cc | bash EnglishFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim ipjudge: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.