@xpr-agents/openclaw 0.8.0 → 0.8.2

package/skills/code-sandbox/dist/index.js

@@ -15,60 +15,75 @@ const DEFAULT_TIMEOUT = 5000;
 const MAX_TIMEOUT = 30000;
 const MAX_OUTPUT_SIZE = 10 * 1024 * 1024; // 10MB
 // ── Sandbox helpers ─────────────────────────────
-function createSandboxGlobals(input, logs) {
-    // Capture console methods
-    const consoleMock = {
-        log: (...args) => {
-            logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-        },
-        warn: (...args) => {
-            logs.push('[warn] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-        },
-        error: (...args) => {
-            logs.push('[error] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-        },
-    };
-    return {
-        INPUT: input,
-        console: consoleMock,
-        JSON,
-        Math,
-        Date,
-        Array,
-        Object,
-        String,
-        Number,
-        RegExp,
-        Map,
-        Set,
-        parseInt,
-        parseFloat,
-        isNaN,
-        isFinite,
-        encodeURIComponent,
-        decodeURIComponent,
-        atob: (s) => Buffer.from(s, 'base64').toString('binary'),
-        btoa: (s) => Buffer.from(s, 'binary').toString('base64'),
-        // Explicitly undefined — blocked
-        require: undefined,
-        process: undefined,
-        globalThis: undefined,
-        global: undefined,
-    };
-}
-function serializeResult(value) {
-    if (value === undefined)
-        return 'undefined';
-    try {
-        const str = JSON.stringify(value, null, 2);
-        if (str.length > MAX_OUTPUT_SIZE) {
-            return str.slice(0, MAX_OUTPUT_SIZE) + '\n... [truncated at 10MB]';
-        }
-        return str;
-    }
-    catch {
-        return String(value);
-    }
+//
+// SECURITY: the context is given ONLY primitive strings — never a host function or
+// object. That is the whole game with node:vm. `codeGeneration.strings:false` only
+// disables eval/Function *for this context's own realm*; a host closure handed in
+// (a console mock, atob/btoa via Buffer, anything) exposes `fn.constructor` — the
+// HOST realm's Function, where code generation is still allowed — so
+// `console.log.constructor("return process.env")()` would read the runner's secrets
+// and `Object.getPrototypeOf(hostFn).constructor.prototype` would pollute the host.
+// So: console, atob/btoa, INPUT parsing and the *result serialization* all run as
+// sandbox-realm code (below). Serializing inside the sandbox also keeps it under the
+// execution timeout — a malicious getter can no longer stall the host via a
+// host-side JSON.stringify. The only value read back out is a JSON string (a
+// primitive), which the host then parses safely.
+/** Sandbox-realm preamble: pure-JS console/atob/btoa/INPUT, no host references. */
+const SANDBOX_PREAMBLE = `
+var __logs = [];
+var console = {
+  log: function(){ __logs.push(Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  warn: function(){ __logs.push('[warn] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  error: function(){ __logs.push('[error] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); }
+};
+var __B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function btoa(s){ s = String(s); var o = ''; for (var i = 0; i < s.length; ) {
+  var c1 = s.charCodeAt(i++), c2 = s.charCodeAt(i++), c3 = s.charCodeAt(i++);
+  var e1 = c1 >> 2, e2 = ((c1 & 3) << 4) | (c2 >> 4), e3 = ((c2 & 15) << 2) | (c3 >> 6), e4 = c3 & 63;
+  if (isNaN(c2)) { e3 = e4 = 64; } else if (isNaN(c3)) { e4 = 64; }
+  o += __B64.charAt(e1) + __B64.charAt(e2) + (e3 === 64 ? '=' : __B64.charAt(e3)) + (e4 === 64 ? '=' : __B64.charAt(e4));
+} return o; }
+function atob(s){ s = String(s).replace(/[^A-Za-z0-9+/=]/g, ''); var o = ''; for (var i = 0; i < s.length; ) {
+  var d1 = __B64.indexOf(s.charAt(i++)), d2 = __B64.indexOf(s.charAt(i++)), d3 = __B64.indexOf(s.charAt(i++)), d4 = __B64.indexOf(s.charAt(i++));
+  var c1 = (d1 << 2) | (d2 >> 4), c2 = ((d2 & 15) << 4) | (d3 >> 2), c3 = ((d3 & 3) << 6) | d4;
+  o += String.fromCharCode(c1); if (d3 !== 64 && d3 >= 0) o += String.fromCharCode(c2); if (d4 !== 64 && d4 >= 0) o += String.fromCharCode(c3);
+} return o; }
+`.trim();
+/**
+ * Run a self-contained expression/body in a fresh vm realm and return the parsed
+ * outcome. `body` must be a statement list whose LAST expression is the user value
+ * to capture. Everything is serialized to a JSON string inside the sandbox.
+ */
+function runInSandbox(body, timeoutMs, inputJson) {
+    // Only a primitive string crosses into the realm — AND the context global is
+    // given a NULL prototype. If we hand vm.createContext an ordinary host object,
+    // the sandbox global inherits the HOST realm's Object.prototype, so
+    // `this.constructor.constructor("return process.env")()` walks to the host
+    // Function (where codeGeneration is allowed) and reads the runner's secrets —
+    // codeGeneration:false only covers THIS context's realm. A null-proto global
+    // makes `this.constructor` resolve to the sandbox realm's own Function, which
+    // the flag then blocks. (Confirmed escape via the global-object path, 2026-09-19.)
+    const sandboxGlobal = Object.create(null);
+    sandboxGlobal.__INPUT_JSON = inputJson;
+    const context = vm_1.default.createContext(sandboxGlobal, {
+        codeGeneration: { strings: false, wasm: false },
+    });
+    const wrapped = `${SANDBOX_PREAMBLE}
+var INPUT = (typeof __INPUT_JSON === 'string') ? JSON.parse(__INPUT_JSON) : undefined;
+var __result, __error = null;
+try { __result = (function(){ ${body} \n})(); } catch (e) { __error = (e && e.message) ? String(e.message) : String(e); }
+(function(){
+  try { return JSON.stringify({ ok: __error === null, result: __result === undefined ? null : __result, logs: __logs, error: __error }); }
+  catch (e) { return JSON.stringify({ ok: __error === null, result: String(__result), logs: __logs, error: __error }); }
+})();`;
+    const script = new vm_1.default.Script(wrapped, { filename: 'sandbox.js' });
+    const out = script.runInContext(context, { timeout: timeoutMs });
+    if (typeof out !== 'string')
+        return { ok: false, logs: [], error: 'sandbox produced no serializable output' };
+    if (out.length > MAX_OUTPUT_SIZE)
+        return { ok: false, logs: [], error: 'Output exceeded 10MB limit', oversized: true };
+    const parsed = JSON.parse(out);
+    return parsed;
 }
 // ── Skill entry point ───────────────────────────
 function codeSandboxSkill(api) {
@@ -97,48 +112,40 @@ function codeSandboxSkill(api) {
                 return { error: 'code parameter is required and must be a string' };
             }
             const timeoutMs = Math.min(Math.max(timeout || DEFAULT_TIMEOUT, 100), MAX_TIMEOUT);
-            const logs = [];
             const startTime = Date.now();
+            let inputJson;
             try {
-                const globals = createSandboxGlobals(input, logs);
-                const context = vm_1.default.createContext(globals, {
-                    codeGeneration: { strings: false, wasm: false },
-                });
-                // Wrap code so the last expression is returned
-                const wrapped = `(function() {\n${code}\n})()`;
-                const script = new vm_1.default.Script(wrapped, { filename: 'sandbox.js' });
-                const result = script.runInContext(context, { timeout: timeoutMs });
+                inputJson = input === undefined ? undefined : JSON.stringify(input);
+            }
+            catch {
+                return { error: 'input could not be serialized to JSON' };
+            }
+            try {
+                const out = runInSandbox(code, timeoutMs, inputJson);
                 const durationMs = Date.now() - startTime;
-                const serialized = serializeResult(result);
-                if (serialized.length > MAX_OUTPUT_SIZE) {
-                    return {
-                        result: serialized.slice(0, 1000) + '... [truncated]',
-                        logs,
-                        duration_ms: durationMs,
-                        warning: 'Output exceeded 10MB limit and was truncated',
-                    };
-                }
-                // Parse back to preserve types (arrays, objects)
-                let parsed;
-                try {
-                    parsed = JSON.parse(serialized);
+                if (out.oversized) {
+                    return { error: 'Output exceeded 10MB limit', logs: out.logs, duration_ms: durationMs, warning: 'Output exceeded 10MB limit and was truncated' };
                 }
-                catch {
-                    parsed = serialized === 'undefined' ? undefined : serialized;
+                if (!out.ok) {
+                    const message = out.error || 'unknown error';
+                    if (message.includes('Code generation from strings disallowed')) {
+                        return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: out.logs, duration_ms: durationMs };
+                    }
+                    return { error: message, logs: out.logs, duration_ms: durationMs };
                 }
-                return { result: parsed, logs, duration_ms: durationMs };
+                return { result: out.result, logs: out.logs, duration_ms: durationMs };
             }
             catch (err) {
                 const durationMs = Date.now() - startTime;
                 const message = err.message || String(err);
-                // Provide helpful error context
-                if (message.includes('Script execution timed out')) {
-                    return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs, duration_ms: durationMs };
+                // Timeout is a hard interrupt thrown to the host, so it lands here.
+                if (message.includes('Script execution timed out') || message.includes('timed out')) {
+                    return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs: [], duration_ms: durationMs };
                 }
                 if (message.includes('Code generation from strings disallowed')) {
-                    return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs, duration_ms: durationMs };
+                    return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: [], duration_ms: durationMs };
                 }
-                return { error: message, logs, duration_ms: durationMs };
+                return { error: message, logs: [], duration_ms: durationMs };
             }
         },
     });
@@ -162,26 +169,20 @@ function codeSandboxSkill(api) {
                 return { error: 'expression parameter is required and must be a string' };
             }
             try {
-                const globals = createSandboxGlobals(undefined, []);
-                const context = vm_1.default.createContext(globals, {
-                    codeGeneration: { strings: false, wasm: false },
-                });
-                const script = new vm_1.default.Script(`(${expression})`, { filename: 'expr.js' });
-                const result = script.runInContext(context, { timeout: DEFAULT_TIMEOUT });
-                let serialized;
-                try {
-                    serialized = JSON.parse(JSON.stringify(result));
-                }
-                catch {
-                    serialized = String(result);
-                }
-                return {
-                    result: serialized,
-                    type: result === null ? 'null' : Array.isArray(result) ? 'array' : typeof result,
-                };
+                // Evaluate as the returned value of the sandbox body (same isolated realm,
+                // in-sandbox serialization). The value comes back as parsed JSON.
+                const out = runInSandbox(`return (${expression});`, DEFAULT_TIMEOUT, undefined);
+                if (!out.ok)
+                    return { error: out.error || 'evaluation failed' };
+                const r = out.result;
+                const type = r === null ? 'null' : Array.isArray(r) ? 'array' : typeof r;
+                return { result: r, type };
             }
             catch (err) {
-                return { error: err.message || String(err) };
+                const message = err.message || String(err);
+                if (message.includes('timed out'))
+                    return { error: `Execution timed out after ${DEFAULT_TIMEOUT}ms.` };
+                return { error: message };
             }
         },
     });

package/skills/code-sandbox/src/index.ts

@@ -25,61 +25,79 @@ const MAX_TIMEOUT = 30000;
 const MAX_OUTPUT_SIZE = 10 * 1024 * 1024; // 10MB
 
 // ── Sandbox helpers ─────────────────────────────
+//
+// SECURITY: the context is given ONLY primitive strings — never a host function or
+// object. That is the whole game with node:vm. `codeGeneration.strings:false` only
+// disables eval/Function *for this context's own realm*; a host closure handed in
+// (a console mock, atob/btoa via Buffer, anything) exposes `fn.constructor` — the
+// HOST realm's Function, where code generation is still allowed — so
+// `console.log.constructor("return process.env")()` would read the runner's secrets
+// and `Object.getPrototypeOf(hostFn).constructor.prototype` would pollute the host.
+// So: console, atob/btoa, INPUT parsing and the *result serialization* all run as
+// sandbox-realm code (below). Serializing inside the sandbox also keeps it under the
+// execution timeout — a malicious getter can no longer stall the host via a
+// host-side JSON.stringify. The only value read back out is a JSON string (a
+// primitive), which the host then parses safely.
+
+/** Sandbox-realm preamble: pure-JS console/atob/btoa/INPUT, no host references. */
+const SANDBOX_PREAMBLE = `
+var __logs = [];
+var console = {
+  log: function(){ __logs.push(Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  warn: function(){ __logs.push('[warn] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  error: function(){ __logs.push('[error] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); }
+};
+var __B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function btoa(s){ s = String(s); var o = ''; for (var i = 0; i < s.length; ) {
+  var c1 = s.charCodeAt(i++), c2 = s.charCodeAt(i++), c3 = s.charCodeAt(i++);
+  var e1 = c1 >> 2, e2 = ((c1 & 3) << 4) | (c2 >> 4), e3 = ((c2 & 15) << 2) | (c3 >> 6), e4 = c3 & 63;
+  if (isNaN(c2)) { e3 = e4 = 64; } else if (isNaN(c3)) { e4 = 64; }
+  o += __B64.charAt(e1) + __B64.charAt(e2) + (e3 === 64 ? '=' : __B64.charAt(e3)) + (e4 === 64 ? '=' : __B64.charAt(e4));
+} return o; }
+function atob(s){ s = String(s).replace(/[^A-Za-z0-9+/=]/g, ''); var o = ''; for (var i = 0; i < s.length; ) {
+  var d1 = __B64.indexOf(s.charAt(i++)), d2 = __B64.indexOf(s.charAt(i++)), d3 = __B64.indexOf(s.charAt(i++)), d4 = __B64.indexOf(s.charAt(i++));
+  var c1 = (d1 << 2) | (d2 >> 4), c2 = ((d2 & 15) << 4) | (d3 >> 2), c3 = ((d3 & 3) << 6) | d4;
+  o += String.fromCharCode(c1); if (d3 !== 64 && d3 >= 0) o += String.fromCharCode(c2); if (d4 !== 64 && d4 >= 0) o += String.fromCharCode(c3);
+} return o; }
+`.trim();
 
-function createSandboxGlobals(input: unknown, logs: string[]): Record<string, unknown> {
-  // Capture console methods
-  const consoleMock = {
-    log: (...args: unknown[]) => {
-      logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-    warn: (...args: unknown[]) => {
-      logs.push('[warn] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-    error: (...args: unknown[]) => {
-      logs.push('[error] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-  };
-
-  return {
-    INPUT: input,
-    console: consoleMock,
-    JSON,
-    Math,
-    Date,
-    Array,
-    Object,
-    String,
-    Number,
-    RegExp,
-    Map,
-    Set,
-    parseInt,
-    parseFloat,
-    isNaN,
-    isFinite,
-    encodeURIComponent,
-    decodeURIComponent,
-    atob: (s: string) => Buffer.from(s, 'base64').toString('binary'),
-    btoa: (s: string) => Buffer.from(s, 'binary').toString('base64'),
-    // Explicitly undefined — blocked
-    require: undefined,
-    process: undefined,
-    globalThis: undefined,
-    global: undefined,
-  };
-}
-
-function serializeResult(value: unknown): string {
-  if (value === undefined) return 'undefined';
-  try {
-    const str = JSON.stringify(value, null, 2);
-    if (str.length > MAX_OUTPUT_SIZE) {
-      return str.slice(0, MAX_OUTPUT_SIZE) + '\n... [truncated at 10MB]';
-    }
-    return str;
-  } catch {
-    return String(value);
-  }
+/**
+ * Run a self-contained expression/body in a fresh vm realm and return the parsed
+ * outcome. `body` must be a statement list whose LAST expression is the user value
+ * to capture. Everything is serialized to a JSON string inside the sandbox.
+ */
+function runInSandbox(
+  body: string,
+  timeoutMs: number,
+  inputJson: string | undefined,
+): { ok: boolean; result?: unknown; logs: string[]; error?: string; oversized?: boolean } {
+  // Only a primitive string crosses into the realm — AND the context global is
+  // given a NULL prototype. If we hand vm.createContext an ordinary host object,
+  // the sandbox global inherits the HOST realm's Object.prototype, so
+  // `this.constructor.constructor("return process.env")()` walks to the host
+  // Function (where codeGeneration is allowed) and reads the runner's secrets —
+  // codeGeneration:false only covers THIS context's realm. A null-proto global
+  // makes `this.constructor` resolve to the sandbox realm's own Function, which
+  // the flag then blocks. (Confirmed escape via the global-object path, 2026-09-19.)
+  const sandboxGlobal: Record<string, unknown> = Object.create(null);
+  sandboxGlobal.__INPUT_JSON = inputJson;
+  const context = vm.createContext(sandboxGlobal, {
+    codeGeneration: { strings: false, wasm: false },
+  });
+  const wrapped = `${SANDBOX_PREAMBLE}
+var INPUT = (typeof __INPUT_JSON === 'string') ? JSON.parse(__INPUT_JSON) : undefined;
+var __result, __error = null;
+try { __result = (function(){ ${body} \n})(); } catch (e) { __error = (e && e.message) ? String(e.message) : String(e); }
+(function(){
+  try { return JSON.stringify({ ok: __error === null, result: __result === undefined ? null : __result, logs: __logs, error: __error }); }
+  catch (e) { return JSON.stringify({ ok: __error === null, result: String(__result), logs: __logs, error: __error }); }
+})();`;
+  const script = new vm.Script(wrapped, { filename: 'sandbox.js' });
+  const out = script.runInContext(context, { timeout: timeoutMs }) as string;
+  if (typeof out !== 'string') return { ok: false, logs: [], error: 'sandbox produced no serializable output' };
+  if (out.length > MAX_OUTPUT_SIZE) return { ok: false, logs: [], error: 'Output exceeded 10MB limit', oversized: true };
+  const parsed = JSON.parse(out) as { ok: boolean; result?: unknown; logs: string[]; error?: string };
+  return parsed;
 }
 
 // ── Skill entry point ───────────────────────────
@@ -113,53 +131,41 @@ export default function codeSandboxSkill(api: SkillApi): void {
       }
 
       const timeoutMs = Math.min(Math.max(timeout || DEFAULT_TIMEOUT, 100), MAX_TIMEOUT);
-      const logs: string[] = [];
       const startTime = Date.now();
 
+      let inputJson: string | undefined;
       try {
-        const globals = createSandboxGlobals(input, logs);
-        const context = vm.createContext(globals, {
-          codeGeneration: { strings: false, wasm: false },
-        });
-
-        // Wrap code so the last expression is returned
-        const wrapped = `(function() {\n${code}\n})()`;
-        const script = new vm.Script(wrapped, { filename: 'sandbox.js' });
-        const result = script.runInContext(context, { timeout: timeoutMs });
-        const durationMs = Date.now() - startTime;
+        inputJson = input === undefined ? undefined : JSON.stringify(input);
+      } catch {
+        return { error: 'input could not be serialized to JSON' };
+      }
 
-        const serialized = serializeResult(result);
-        if (serialized.length > MAX_OUTPUT_SIZE) {
-          return {
-            result: serialized.slice(0, 1000) + '... [truncated]',
-            logs,
-            duration_ms: durationMs,
-            warning: 'Output exceeded 10MB limit and was truncated',
-          };
+      try {
+        const out = runInSandbox(code, timeoutMs, inputJson);
+        const durationMs = Date.now() - startTime;
+        if (out.oversized) {
+          return { error: 'Output exceeded 10MB limit', logs: out.logs, duration_ms: durationMs, warning: 'Output exceeded 10MB limit and was truncated' };
         }
-
-        // Parse back to preserve types (arrays, objects)
-        let parsed: unknown;
-        try {
-          parsed = JSON.parse(serialized);
-        } catch {
-          parsed = serialized === 'undefined' ? undefined : serialized;
+        if (!out.ok) {
+          const message = out.error || 'unknown error';
+          if (message.includes('Code generation from strings disallowed')) {
+            return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: out.logs, duration_ms: durationMs };
+          }
+          return { error: message, logs: out.logs, duration_ms: durationMs };
         }
-
-        return { result: parsed, logs, duration_ms: durationMs };
+        return { result: out.result, logs: out.logs, duration_ms: durationMs };
       } catch (err: any) {
         const durationMs = Date.now() - startTime;
         const message = err.message || String(err);
 
-        // Provide helpful error context
-        if (message.includes('Script execution timed out')) {
-          return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs, duration_ms: durationMs };
+        // Timeout is a hard interrupt thrown to the host, so it lands here.
+        if (message.includes('Script execution timed out') || message.includes('timed out')) {
+          return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs: [], duration_ms: durationMs };
         }
         if (message.includes('Code generation from strings disallowed')) {
-          return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs, duration_ms: durationMs };
+          return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: [], duration_ms: durationMs };
         }
-
-        return { error: message, logs, duration_ms: durationMs };
+        return { error: message, logs: [], duration_ms: durationMs };
       }
     },
   });
@@ -185,27 +191,17 @@ export default function codeSandboxSkill(api: SkillApi): void {
       }
 
       try {
-        const globals = createSandboxGlobals(undefined, []);
-        const context = vm.createContext(globals, {
-          codeGeneration: { strings: false, wasm: false },
-        });
-
-        const script = new vm.Script(`(${expression})`, { filename: 'expr.js' });
-        const result = script.runInContext(context, { timeout: DEFAULT_TIMEOUT });
-
-        let serialized: unknown;
-        try {
-          serialized = JSON.parse(JSON.stringify(result));
-        } catch {
-          serialized = String(result);
-        }
-
-        return {
-          result: serialized,
-          type: result === null ? 'null' : Array.isArray(result) ? 'array' : typeof result,
-        };
+        // Evaluate as the returned value of the sandbox body (same isolated realm,
+        // in-sandbox serialization). The value comes back as parsed JSON.
+        const out = runInSandbox(`return (${expression});`, DEFAULT_TIMEOUT, undefined);
+        if (!out.ok) return { error: out.error || 'evaluation failed' };
+        const r = out.result;
+        const type = r === null ? 'null' : Array.isArray(r) ? 'array' : typeof r;
+        return { result: r, type };
       } catch (err: any) {
-        return { error: err.message || String(err) };
+        const message = err.message || String(err);
+        if (message.includes('timed out')) return { error: `Execution timed out after ${DEFAULT_TIMEOUT}ms.` };
+        return { error: message };
       }
     },
   });

package/skills/creative/dist/index.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDeliverable = getDeliverable;
 exports.default = creativeSkill;
+const ssrf_1 = require("./ssrf");
 // ── Shared helpers ──────────────────────────────
 const MAX_DELIVERABLES = 200;
 const deliverables = new Map();
@@ -121,7 +122,9 @@ async function downloadFromUrl(url) {
     if (!/^https?:\/\//.test(url))
         return null;
     try {
-        const resp = await fetch(url, { signal: AbortSignal.timeout(30000), redirect: 'follow' });
+        // SSRF: the URL is agent/job-controlled and this runs inside a private network.
+        // guardedFetch refuses private/internal targets and re-validates each redirect.
+        const resp = await (0, ssrf_1.guardedFetch)(url, { signal: AbortSignal.timeout(30000) });
         if (!resp.ok)
             return null;
         const contentType = resp.headers.get('content-type') || 'application/octet-stream';
@@ -156,7 +159,8 @@ function extractImages(text) {
 }
 async function downloadImage(url) {
     try {
-        const resp = await fetch(url, { signal: AbortSignal.timeout(15000) });
+        // SSRF: image URLs come from agent-authored markdown — guard + re-validate redirects.
+        const resp = await (0, ssrf_1.guardedFetch)(url, { signal: AbortSignal.timeout(15000) });
         if (!resp.ok)
             return null;
         const ct = (resp.headers.get('content-type') || '').split(';')[0].trim();

package/skills/creative/dist/ssrf.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = isPrivateAddress;
+exports.assertPublicUrl = assertPublicUrl;
+exports.guardedFetch = guardedFetch;
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+function isPrivateAddress(ip) {
+    const v = (0, node_net_1.isIP)(ip);
+    if (v === 4) {
+        const p = ip.split('.').map(Number);
+        if (p.length !== 4 || p.some(n => Number.isNaN(n)))
+            return true;
+        const [a, b, c] = p;
+        return (a === 0 || a === 10 || a === 127 ||
+            (a === 169 && b === 254) || // link-local + cloud metadata
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 192 && b === 0 && c === 0) || // 192.0.0.0/24 (IETF protocol assignments)
+            (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 (benchmarking)
+            (a === 100 && b >= 64 && b <= 127) || // CGNAT
+            a >= 224 // multicast / reserved
+        );
+    }
+    if (v === 6) {
+        const s = ip.toLowerCase();
+        return (s === '::1' || s === '::' ||
+            s.startsWith('::ffff:') || // IPv4-mapped
+            s.startsWith('64:ff9b') || // NAT64 well-known prefix
+            /^fe[89a-f]/.test(s) || // link-local fe80::/10 + site-local fec0::/10
+            s.startsWith('fc') || s.startsWith('fd') // unique-local
+        );
+    }
+    return true;
+}
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+async function assertPublicUrl(urlStr) {
+    let host;
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+        }
+        host = u.hostname;
+    }
+    catch (e) {
+        throw new Error(`Blocked invalid URL: ${e.message}`);
+    }
+    if ((0, node_net_1.isIP)(host)) {
+        if (isPrivateAddress(host))
+            throw new Error(`Blocked private address: ${host}`);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await (0, promises_1.lookup)(host, { all: true });
+    }
+    catch {
+        throw new Error(`Blocked host that does not resolve: ${host}`);
+    }
+    if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+        throw new Error(`Blocked host resolving to a private address: ${host}`);
+    }
+}
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+async function guardedFetch(url, init = {}, maxRedirects = 3) {
+    let current = url;
+    for (let i = 0; i <= maxRedirects; i++) {
+        await assertPublicUrl(current);
+        const resp = await fetch(current, { ...init, redirect: 'manual' });
+        if (resp.status >= 300 && resp.status < 400) {
+            const loc = resp.headers.get('location');
+            if (!loc)
+                return resp;
+            current = new URL(loc, current).toString();
+            continue;
+        }
+        return resp;
+    }
+    throw new Error(`Too many redirects (>${maxRedirects})`);
+}