Hardcoded Suspicious IP Address in Skill Content
A skill or plugin published for AI agents contains a literal IP address that matches infrastructure known to be used by malware for command-and-control. This suggests the skill was built to phone home to an attacker-controlled server rather than perform its stated function.
How the attack works
An attacker publishes a skill (in this case named 'sakaen736jih/youtube-watcher-p') to a marketplace or repository that agents can install. The skill's code or configuration contains a hardcoded IP address (91.92.242.30) that has been identified as a known C2 server. When an agent installs and runs the skill, it can connect to that address, giving the attacker a channel to send commands or exfiltrate data from the agent's environment. The malicious network reference is buried inside otherwise plausible-looking functionality.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d772ffdb-3dcb-481e-8e74-cf1dd4582391
- Severity
- High
Why it matters
An organization that installs the affected skill risks having its agent silently communicate with attacker infrastructure, enabling remote control, data theft, or further payload delivery without the operator's knowledge.
What you can do
- →Scan installed skills and plugins for hardcoded IP addresses and cross-check them against threat intelligence feeds before deployment.
- →Remove or quarantine the named skill ('sakaen736jih/youtube-watcher-p') if it is installed, and audit any agent that has used it.
- →Restrict agents' outbound network access to an allowlist of known-good destinations instead of unrestricted internet access.
- →Review skill code manually or with static analysis before granting it network permissions, and treat any skill needing raw IP connectivity as high-risk.
Known benign look-alikes
- Security research documentation describing C2 patterns
- Threat intelligence feeds in legitimate security tools
- Network monitoring tools documenting suspicious activity