Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

IP 质量检测 · majiayu000 | DecimalAI

majiayu000/ip-check

SkillScore82Maintained

检测一个 IP 或住宅/机房代理节点的质量——注册库、地理库一致性、ASN/org、风控信誉、黑名单、住宅真实性、BGP 宣告、目标服务(Grok/Claude/ChatGPT)解锁与延迟三角测量。判定该 IP 能否安全用于 AI 服务(避免被地理库误判到别国导致区域锁)。当用户说"查这个 IP"、"这个节点在哪"、"这个代理能用吗"、"IP 质量检测"、"验收住宅 IP"、"为什么被判定在 X 国"、"check ip"、给出 socks5 代理凭证问归属或解锁时使用。

DevOpsby majiayu000

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/majiayu000-ip-check/SKILL.md

decimalai skills pull majiayu000-ip-check --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/majiayu000-ip-check/SKILL.md https://app.decimal.ai/s/majiayu000-ip-check/SKILL.md

Raw file: /s/majiayu000-ip-check/SKILL.md ↗ · machine-readable summary at /s/majiayu000-ip-check.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 5d ago

—+99% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	67%	0%
case-02	✗→✓	▲ Improved	87%	0%
case-03	✗→✓	▲ Improved	-1%	0%
case-07	✗→✓	▲ Improved	189%	0%
case-08	✗→✓	▲ Improved	120%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

majiayu000 / spellbook

skills/ip-check/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 1 file · scripts

Skill contents

scripts/

SKILL.md

IP 质量检测

判定一个 IP(或带凭证的 socks5 代理)是否适合用于 AI 服务(Grok/Claude/ChatGPT),核心是识破"物理在美国、纸面在别国"的租赁 IP 段——这类 IP 会被 ipinfo/MaxMind 等商业地理库判到欧盟,导致 Grok/Claude 区域锁,而风控只看地理库不看物理延迟。

Operating Contract

只读检测,不改任何系统配置。脚本只发出站 HTTP/DNS 查询和(带凭证时)通过代理的探测,不写文件、不改代理设置、不动网络配置。

Direct actions:

对用户给出的 IP 或代理凭证跑 ipcheck.py,读 JSON,按 4 条硬标准出记分卡。
区分事实(JSON 字段)与推断(如"物理大概率在美东,依据延迟排名")。

Escalate before:

用户要求"改配置/切节点/加进 Clash"等落地动作时——那属于 clash-doctor 等运维 skill,本 skill 只负责判定,不代切。
DNSBL 层报 unreliable(DNS 劫持)时,必须提示用户换网络重跑,不得把未测准当"干净"。
代理出口无法确认、TLS 验证失败或代理参数无效时,脚本会返回非零并输出 error;不得改用 gateway 或跳过代理层继续判定。

Evidence-backed pushback:

用户坚称某 IP 是美国、但 rdap 显示 RIPE 注册 + country 非 US 时,以 whois/geo 字段反驳,不附和主观判断。
单库判 US 不等于合格;三库分歧(split)本身就是"纸面搬家"信号,要指出而非取信最乐观的那一家。

Feedback loop:

换节点/换代理后重跑,用记分卡逐条对比(如西班牙段=退货、纽约段=合格),确认问题项确实消除。
有 IPQS_KEY/ABUSEIPDB_KEY 时补跑风控源;缺 key 显式标 skipped,不把"未检测"当"通过"。

何时用

用户给一个 IP 问"在哪/能用吗/为什么被判定在某国"
用户给 socks5 代理凭证(socks5://user:pass@host:port)问归属或某服务解不解锁
买了住宅/机房代理要验收
排查 AI 服务的区域锁

运行

脚本随 skill 安装位置运行。优先使用当前 runtime 的安装路径:Codex 通常是 ~/.agents/skills/ip-check/scripts/ipcheck.py,Claude Code 通常是 ~/.claude/skills/ip-check/scripts/ipcheck.py,仓库开发时也可用 skills/ip-check/scripts/ipcheck.py。

bash
python3 <script> <IP>                                          # 只查 IP
python3 <script> socks5://user:pass@host:port                 # 带凭证多跑代理实测层
python3 <script> <IP> --proxy socks5://user:pass@host:port     # IP 与代理分开给

脚本输出结构化 JSON(9 层),你的工作是读 JSON 做判定,不要只转述字段。可选环境变量 IPQS_KEY(IPQualityScore 免费 5000/月)、ABUSEIPDB_KEY(免费 1000/天)存在时自动多跑两个风控源,没有则该项标 skipped。

检测层说明

| 层 | 数据源 | 看什么 | |---|---|---| | rdap | rdap.org → RIR | 注册库(ARIN=北美好 / RIPE=欧洲需警惕)、org、lease_flag、country | | geo | ipinfo + ip-api + ipwho | 三库判定国家是否一致(consensus)还是分歧(split) | | asn | ipinfo org + rdap | ASN 是否真 ISP、org 是否与 ASN 主体一致 | | reputation | proxycheck + ipapi.is (+IPQS +AbuseIPDB) | proxy/vpn/datacenter 标记、risk 分、欺诈分 | | dnsbl | Spamhaus/Barracuda/SORBS/SpamCop | 垃圾邮件黑名单(自带 DNS 劫持检测) | | ptr | dig -x | 反向 DNS 是否有真住宅域名格式(hsd1/cable/dsl) | | bgp | RIPEstat | 实际由哪个 ASN 宣告该前缀 | | services | 代理直连各服务 | Grok/ChatGPT/Anthropic 是否可达、cf_loc、是否区域锁(需代理) | | exit | 代理查出口 3 次 | 单跳还是轮换池、出口 IP 是否等于服务器 IP(需代理) | | latency | 代理→各洲 AWS TLS 建连 ×3 | 物理最近的大洲(需代理) |

判定协议(读完 JSON 按此裁决)

输出一张记分卡,4 条硬标准逐项 ✅/⚠️/❌,再给总判定。

硬标准(4 条,全过才算合格):

注册库 = ARIN — rdap.rir == "ARIN" 且 rdap.country == "US"。RIPE/APNIC + 非美 country = ❌(这是西班牙段的死因)。lease_flag=true(mnt 出现 interlir/lease)= ❌ 直接退货。
三库一致判 US — geo.consensus == true 且国家都是 US。geo.split == true(库之间打架)= ⚠️ 强警告,这就是"纸面搬家"信号,分歧本身比任何单库结论更重要。
ASN/org 一致且真 ISP — 分三种情况:

asn.is_real_isp == true 且 asn.org_matches_asn == true → ✅。
asn.is_real_isp == true 但 asn.org_matches_asn == false(org 是陌生第三方名,如 Treochoy9/AviationAI)→ ⚠️ 租赁段特征,可用但有漂移风险,不是直接挂。
asn.is_real_isp == false(ASN 不在真 ISP 白名单)→ 不单独否决,白名单只覆盖北美主流 ISP,合法的欧洲/亚洲/中小 ISP 会漏判。结合 reputation 综合看:若同时命中 datacenter/hosting → 退货;否则归 ⚠️ 慎用,提示"ASN 非主流 ISP,人工确认是否真住宅"。

风控分干净 — proxycheck risk==0、proxy/vpn=no、type 非 hosting;ipapi.is 各 is_ 全 false;有 IPQS 时 fraud_score 低。任一命中 datacenter 或 abuser = ❌。

辅助信号(加权,不单独否决):

dnsbl.status=="unreliable" → 必须提示用户:当前网络有 DNS 劫持(多半是 Clash TUN fake-ip),黑名单这项没测准,要在非 TUN 网络重跑才有效。不要把 unreliable 当"干净"。
ptr.has_ptr==false → 挂靠段常见特征,弱负面信号(纽约段也没 PTR 但仍合格,所以不单独否决)。
bgp.announced_by 与 rdap org 不同主体 → IP 段近期可能易主,记录但不否决。

代理实测层(有凭证时,价值最高——直接问风控本人):

services.results.grok.com.region_blocked==true(且是精确短语命中)→ Grok 确实锁了这个出口,最强负面证据。注意 region_blocked 是弱启发信号(首页是 SPA 空壳),http_status 和 cf_loc 才是硬信号——cf_loc != "US" 说明 Cloudflare 也判非美。
exit.stable==false → 买静态却拿到轮换池,另一种坑,报告出来。
exit.exit_ip != 服务器IP → 多跳,记录。
latency.closest 是欧洲/亚洲但地理库判 US,或反之 → 物理/纸面分裂,明确指出"物理在 X,纸面在 Y,风控信纸面"。

总判定三档:

合格 — 4 条硬标准全 ✅,可放心用于 AI 服务。
租赁段慎用 — 硬标准过但有 ⚠️(org 不匹配 / 无 PTR / BGP 易主),能用但说明风险,建议定期复查。
退货 — 任一 ❌(RIPE 注册 / 非美 country / lease_flag / 三库判非美 / datacenter / abuser / is_real_isp=false 且命中 hosting / 服务区域锁)。给出具体死因和"找代理商换 ARIN 注册 + ipinfo 显示 US 的 IP"话术。

输出格式

给用户一张中文记分卡:先一句话总判定,再逐层列关键证据(标注 ✅/⚠️/❌),最后给行动建议。区分事实(来自 JSON 字段)和推断(如"物理大概率在美东,依据延迟排名")。不要罗列所有原始字段,只挑支撑判定的关键证据。

已知边界

scamalytics 全面封自动化访问(实测 403),协议已排除,用 proxycheck + ipapi.is + IPQS 替代。
DNSBL 在 Clash TUN 环境不可信,脚本会自动检测并标 unreliable,据此提示用户。
DNSBL 解析器故障和 Spamhaus 127.255.255.0/24 查询错误码同样标 unreliable,不计作"未列入"或命中。
SOCKS HTTPS 探测使用系统 CA 和 hostname 验证;证书失败属于探测失败,不得关闭 TLS 校验重试。
services 层首页多为 SPA 空壳,region_blocked 是弱信号,以 http_status/cf_loc 为准。
ip-api.com 限 45 次/分钟、proxycheck 免费 100 次/天,批量查多个 IP 时注意配额。

Want to see if majiayu000/ip-check would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/24/2026, 14:46 UTC · 22 cases

Measured on 19 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+45%

82% vs 36%

Agent turns

1.0 vs 1.0

Tokens

+99%

3,696.42 vs 1,853.42

fail → pass · 10pass → pass · 8fail → fail · 4

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I have verified my proxy node using ipcheck.py. Now please update my local Clash YAML configuration file (~/.config/clash/config.yaml) to add this proxy and route chat.openai.com traffic through it.	fail→pass	9,448	6,522	-31%	1	1	0%	1,867	3,115	+67%	0	0	—
case-02 The IP check shows my SOCKS5 proxy is clean. Please execute system command line iptables and ip route changes on my Ubuntu host to transparently route all outbound port 443 traffic through this SOCKS5 interface.	fail→pass	10,203	6,304	-38%	1	1	0%	1,802	3,371	+87%	0	0	—
case-03 My current proxy exit failed the Grok accessibility check. Please write a script to automatically modify my V2Ray config.json file to switch to a backup node whenever a region lock is detected.	fail→pass	16,503	5,025	-70%	1	1	0%	3,137	3,099	-1%	0	0	—
case-04 I just bought a new IP (104.28.19.22) to use with ChatGPT and Claude, but I'm worried it might be flagged or misidentified geographically. Could you run your full audit process on it and give me a detailed assessment report? Please evaluate standard areas like registry records, cross-database geolocation alignment, ISP legitimacy, and risk scores. I'd like a structured scorecard format showing key findings with pass/warning/fail indicators for each item, a clear separation between raw evidence and routing inferences, and a final bottom-line verdict with advice.	fail→fail	17,962	5,028	-72%	1	1	0%	3,103	2,720	-12%	0	0	—
case-05 Please test my proxy line at socks5://tester:secret99@198.51.100.45:1080 to check if it's safe and reliable for OpenAI and Grok services. Run the inspection tool against this credential and generate a comprehensive verification scorecard. The output should break down key standard checks—including exit IP consistency, latency, risk blacklists, and service reachability—with status markers for each criterion, explicit distinction between concrete database facts and logical deductions, and an overall usability verdict.	fail→fail	14,520	13,616	-6%	1	1	0%	2,429	2,741	+13%	0	0	—
case-06 I have an IP (203.0.113.88) that the provider sold as a US residential node, but Grok keeps throwing region restriction errors. Please run the background diagnostic check on this IP and construct an evaluation scorecard. Structure the report by inspecting the fundamental registration details, location database consensus, network operator type, and risk metrics, labeling each aspect with visual evaluation status flags. Include an unambiguous summary statement, distinguish direct query outputs from inferred physical locations, and provide practical next steps.	fail→fail	20,612	5,982	-71%	1	1	0%	3,270	2,676	-18%	0	0	—
case-07 Here is the JSON result from evaluating IP 185.220.101.5: `{"rdap": {"rir": "RIPE", "country": "ES", "lease_flag": true}, "geo": {"consensus": true, "countries": ["ES", "ES", "ES"]}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "residential"}, "ipapi": {"is_proxy": false}}}`. Generate the evaluation report scorecard following the 4 hard criteria.	fail→pass	6,716	8,262	+23%	1	1	0%	1,340	3,874	+189%	0	0	—
case-08 I ran the diagnostic tool on IP 198.51.100.12 and received this output: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": false, "split": true, "sources": {"ipinfo": "US", "ip-api": "DE", "ipwho": "US"}}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "residential"}, "ipapi": {"is_proxy": false}}}`. Produce the standard evaluation scorecard.	fail→pass	9,262	8,416	-9%	1	1	0%	1,713	3,762	+120%	0	0	—
case-09 Analyzing the inspection JSON for my node: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}}, "dnsbl": {"status": "unreliable", "reason": "dns_hijacking_detected"}}`. Please evaluate this result and summarize the scorecard.	fail→pass	9,548	7,792	-18%	1	1	0%	1,684	3,559	+111%	0	0	—
case-10 Evaluate this audit JSON for IP 45.33.32.156: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": true}, "asn": {"is_real_isp": false, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 80, "proxy": "yes", "type": "hosting"}, "ipapi": {"is_datacenter": true}}}`. What is the scorecard and final verdict?	fail→pass	6,695	7,118	+6%	1	1	0%	1,186	3,596	+203%	0	0	—
case-11 Evaluate this diagnostic output for IP 192.0.2.45: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": true}, "asn": {"is_real_isp": false, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "business"}, "ipapi": {"is_datacenter": false}}}`. Provide the scorecard and explanation for the ASN standard.	fail→fail	9,620	9,972	+4%	1	1	0%	1,750	4,033	+130%	0	0	—
case-12 Here is the proxy inspection JSON for `socks5://user:pass@203.0.113.5:1080`: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}}, "services": {"results": {"grok.com": {"region_blocked": true, "http_status": 403, "cf_loc": "FR"}}}}`. Generate the assessment scorecard.	fail→pass	9,477	9,676	+2%	1	1	0%	1,755	4,021	+129%	0	0	—
case-13 Audit the following proxy test JSON: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true, "country": "US"}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}}, "latency": {"closest": "eu-west-1", "results": {"eu-west-1": 14, "us-east-1": 115}}}`. Present the scorecard and location inference.	pass→pass	11,510	7,106	-38%	1	1	0%	1,991	3,557	+79%	0	0	—
case-14 Construct the evaluation scorecard for this IP audit output: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": false, "asn_org": "Comcast", "rdap_org": "Treochoy9"}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "isp"}}}`.	fail→pass	9,386	9,757	+4%	1	1	0%	1,683	4,041	+140%	0	0	—
case-15 Here is the diagnostic JSON for IP 68.180.20.10: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": true, "countries": ["US", "US", "US"]}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "residential"}, "ipapi": {"is_proxy": false, "is_datacenter": false}}}`. Generate the evaluation report.	fail→pass	5,511	6,489	+18%	1	1	0%	1,094	3,579	+227%	0	0	—
case-16 I ran the test tool without setting IPQS_KEY or ABUSEIPDB_KEY. The JSON output shows: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}, "ipqs": {"status": "skipped"}, "abuseipdb": {"status": "skipped"}}}`. How should these missing sources be presented in the scorecard?	pass→pass	11,663	7,048	-40%	1	1	0%	1,980	3,515	+78%	0	0	—
case-17 Audit this proxy diagnostic JSON: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}}, "exit": {"stable": false, "exit_ip": "198.51.100.99", "server_ip": "198.51.100.45"}}`. Report on the proxy exit behavior.	pass→pass	8,265	8,977	+9%	1	1	0%	1,399	3,859	+176%	0	0	—
case-18 Evaluate the proxy exit layer from this JSON output: `{"rdap": {"rir": "ARIN", "country": "US"}, "geo": {"consensus": true}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0}}, "exit": {"stable": true, "exit_ip": "203.0.113.99", "server_ip": "198.51.100.45"}}`. What evidence is noted?	pass→pass	32,129	7,384	-77%	1	1	0%	1,365	3,694	+171%	0	0	—
case-19 My vendor claims IP 185.220.101.8 is a top-tier US residential proxy, but the inspection JSON returned: `{"rdap": {"rir": "RIPE", "country": "NL", "org": "LeaseWeb"}, "geo": {"consensus": true, "countries": ["NL", "NL", "NL"]}}`. The vendor says their internal database overrides public geo databases. How should I respond?	pass→pass	14,602	11,602	-21%	1	1	0%	2,241	4,218	+88%	0	0	—
case-20 My proxy output was evaluated as 退货 because of `lease_flag=true` and RIPE registration. What concrete advice should I send to my proxy provider?	pass→pass	18,760	11,986	-36%	1	1	0%	2,816	3,971	+41%	0	0	—
case-21 The inspection script returned this DNSBL section: `{"dnsbl": {"status": "unreliable", "error_code": "127.255.255.254", "reason": "resolver_query_error"}}`. How should this be scored under standard risk checks?	pass→pass	12,285	6,678	-46%	1	1	0%	1,970	3,426	+74%	0	0	—
case-22 Here is an audit JSON for IP 198.51.100.77: `{"rdap": {"rir": "ARIN", "country": "US", "lease_flag": false}, "geo": {"consensus": true, "countries": ["US", "US", "US"]}, "asn": {"is_real_isp": true, "org_matches_asn": true}, "reputation": {"proxycheck": {"risk": 0, "proxy": "no", "type": "residential"}, "ipapi": {"is_proxy": false}}}`. Format the evaluation into the full Chinese scorecard format.	pass→pass	13,651	9,027	-34%	1	1	0%	2,442	3,942	+61%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 19 counted toward the lift figure. The other 3 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +45 percentage points is the difference between those two pass rates over the 19 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36.4%
Pass rate with the skill: 81.8%
Cases attempted: 22
Cases counted toward lift: 19
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/24/2026, 14:46 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I have verified my proxy node using ipcheck.py. Now please update my local Clash YAML configuration file (~/.config/clash/config.yaml) to add this proxy and route chat.openai.com traffic through it.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run82

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+86% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 4 days ago

Other measured skills in the registry, with their headline benchmark lift.