A security service that tracks IP addresses linked to abusive or suspicious activity. It provides information for checking, reporting, and scoring IP addresses.

Use it to check IP reputation, report abusive addresses, and add threat information to security detections.

It helps developers investigate questionable network traffic without building their own abuse database. It can support decisions about whether an IP address should be blocked or reviewed.

absue-ip-db — Skill for Claude Code and Codex by withoneai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add withoneai/one-agent-plugin --skill absue-ip-db

Clone the repo

git clone --depth 1 https://github.com/withoneai/one-agent-plugin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/withoneai/one-agent-plugin/absue-ip-db.svg)](https://agentmods.dev/skills/withoneai/one-agent-plugin/absue-ip-db)

Your own site

<a href="https://agentmods.dev/skills/withoneai/one-agent-plugin/absue-ip-db"><img src="https://agentmods.dev/badge/skills/withoneai/one-agent-plugin/absue-ip-db.svg" alt="Measured on agentmods" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,503 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.01503
Opus 5	$0.00000	$0.00751
Sonnet 5	$0.00000	$0.00301
Haiku 4.5	$0.00000	$0.00150

Measured 7d ago against content hash 492b3438744c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

absue-ip-db scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

platforms/one-absue-ip-db/skills/absue-ip-db/SKILL.md · 103 lines

How it starts

The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AbuseIPDB through One

AbuseIPDB is a threat intelligence platform that provides an API for checking, reporting, and scoring IP addresses associated with abusive activity, allowing security teams and developers to enrich detections, automate blocking decisions, and investigate suspicious network traffic.

One exposes AbuseIPDB through four MCP tools. The table below carries real action ids from One's knowledge base, so for a common operation you can skip search and go straight to reading the action's parameters.

How to run an action

Find the action in the table below, or call search_one_platform_actions with platform absue-ip-db if it is not listed.
Call get_one_action_knowledge with the action id. Do this every time, including for actions in this table. The table gives you the id, not the parameters.
Call execute_one_action with parameters copied from that knowledge.

Never guess a parameter name, a body field, or an enum value. The knowledge has the real schema, and a guessed field is either a 400 or a silent write of the wrong thing.

Before you start

Call list_one_integrations once and confirm AbuseIPDB is connected. If it is missing, the user has not connected it: say so and point them at https://app.withone.ai rather than reaching for raw HTTP.

Each connection carries an access field. If it reports {"policy": "methods", "methods": ["GET"]} the agent is read-only here, so plan a read-only answer instead of attempting a write that will be refused.

Before a write

Creates, updates, deletes and sends land on a real AbuseIPDB account and cannot be recalled. State the action and the specific target in one line before the first write in a task, and let the user stop you. Reads need no confirmation.

Actions

Blacklist

Action	Method	Path	Action id
Blacklist IP Addresses	GET	`/api/v2/blacklist`	`conn_mod_def::GKsecaSVsSA::-o_6UVT9SRyCilX0u1AOEA`
Filter the Blacklist by Country	GET	`/api/v2/blacklist`	`conn_mod_def::GKsebju9xSg::k3ocjeQ8RVC1wxhfAVQgCA`
Get the Blacklist	GET	`/api/v2/blacklist`	`conn_mod_def::GKsebk50hsA::pVuZoPfIRgKSbBOcsWT4Yw`

Read the full file on GitHub · 103 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 103 lines · 0 tokens per session scan A 492b3438744c

Subscribe to this mod's changes

absue-ip-db is a skill published in the GitHub repository withoneai/one-agent-plugin (1 stars, last pushed 18d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,503 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Security agent-plugins agent-skills ai-agents integrations mcp

TEMPLATE

../../../agents/personas/TEMPLATE.md.

alirezarezvani/claude-skills · 0 tokens

document-service

This skill should be used when the user asks to "analyze this codebase", "document this service", "generate technical docs", "I inherited this code", "help me understand this system", "create docs for this project", "what does this system look like", "onboard me to this codebase", "this codebase has no docs"…

awslabs/agent-plugins · 141 tokens

experience_loader

Load relevant OpenViking experience memories via case-linked experience candidates before solving a task.

volcengine/OpenViking · 20 tokens

sdk-getting-started

Validates the user's environment for SageMaker AI operations — checks SDK version, AWS region, and execution role. Use when the user says "set up", "getting started", "check my environment", "configure SDK", or as the first step in any plan involving SageMaker/Bedrock training, evaluation, or deployment.

awslabs/agent-plugins · 71 tokens

using-agent-brain

Expert Agent Brain skill for document search with BM25 keyword, semantic vector, hybrid, graph, and multi retrieval modes. Use when asked to "search documentation", "query domain", "find in docs", "bm25 search", "hybrid search", "semantic search", "graph search", "multi search", "find dependencies", "code…

SpillwaveSolutions/agent-brain · 249 tokens

gsd-complete-milestone

Archive completed milestone and prepare for next version.

SpillwaveSolutions/agent-brain · 16 tokens