This seems insecure to me still, as you're querying an arbitrary IP address and then loading the YAML returned.  I think refreshFacts needs securing first (i.e. it should only handle JSON via JSON.load) for this work.