@xpr-agents/openclaw 0.8.0 → 0.8.2

package/skills/creative/src/index.ts

@@ -5,6 +5,8 @@
  * Extracted from the main agent runner to validate the skill module format.
  */
 
+import { guardedFetch } from './ssrf';
+
 interface ToolDef {
   name: string;
   description: string;
@@ -132,7 +134,9 @@ const MAX_DOWNLOAD_SIZE = 50 * 1024 * 1024;
 async function downloadFromUrl(url: string): Promise<{ buffer: Buffer; mimeType: string } | null> {
   if (!/^https?:\/\//.test(url)) return null;
   try {
-    const resp = await fetch(url, { signal: AbortSignal.timeout(30000), redirect: 'follow' });
+    // SSRF: the URL is agent/job-controlled and this runs inside a private network.
+    // guardedFetch refuses private/internal targets and re-validates each redirect.
+    const resp = await guardedFetch(url, { signal: AbortSignal.timeout(30000) });
     if (!resp.ok) return null;
     const contentType = resp.headers.get('content-type') || 'application/octet-stream';
     const contentLength = parseInt(resp.headers.get('content-length') || '0');
@@ -161,7 +165,8 @@ function extractImages(text: string): { alt: string; url: string }[] {
 
 async function downloadImage(url: string): Promise<{ buffer: Buffer; type: string } | null> {
   try {
-    const resp = await fetch(url, { signal: AbortSignal.timeout(15000) });
+    // SSRF: image URLs come from agent-authored markdown — guard + re-validate redirects.
+    const resp = await guardedFetch(url, { signal: AbortSignal.timeout(15000) });
     if (!resp.ok) return null;
     const ct = (resp.headers.get('content-type') || '').split(';')[0].trim();
     if (!ct.startsWith('image/')) return null;

package/skills/creative/src/ssrf.ts

@@ -0,0 +1,91 @@
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+export function isPrivateAddress(ip: string): boolean {
+  const v = isIP(ip);
+  if (v === 4) {
+    const p = ip.split('.').map(Number);
+    if (p.length !== 4 || p.some(n => Number.isNaN(n))) return true;
+    const [a, b, c] = p;
+    return (
+      a === 0 || a === 10 || a === 127 ||
+      (a === 169 && b === 254) ||               // link-local + cloud metadata
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 192 && b === 0 && c === 0) ||      // 192.0.0.0/24 (IETF protocol assignments)
+      (a === 198 && (b === 18 || b === 19)) ||  // 198.18.0.0/15 (benchmarking)
+      (a === 100 && b >= 64 && b <= 127) ||     // CGNAT
+      a >= 224                                    // multicast / reserved
+    );
+  }
+  if (v === 6) {
+    const s = ip.toLowerCase();
+    return (
+      s === '::1' || s === '::' ||
+      s.startsWith('::ffff:') ||                 // IPv4-mapped
+      s.startsWith('64:ff9b') ||                 // NAT64 well-known prefix
+      /^fe[89a-f]/.test(s) ||                    // link-local fe80::/10 + site-local fec0::/10
+      s.startsWith('fc') || s.startsWith('fd')   // unique-local
+    );
+  }
+  return true;
+}
+
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+export async function assertPublicUrl(urlStr: string): Promise<void> {
+  let host: string;
+  try {
+    const u = new URL(urlStr);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+      throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+    }
+    host = u.hostname;
+  } catch (e) {
+    throw new Error(`Blocked invalid URL: ${(e as Error).message}`);
+  }
+  if (isIP(host)) {
+    if (isPrivateAddress(host)) throw new Error(`Blocked private address: ${host}`);
+    return;
+  }
+  let addrs: { address: string }[];
+  try {
+    addrs = await lookup(host, { all: true });
+  } catch {
+    throw new Error(`Blocked host that does not resolve: ${host}`);
+  }
+  if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+    throw new Error(`Blocked host resolving to a private address: ${host}`);
+  }
+}
+
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+export async function guardedFetch(url: string, init: RequestInit = {}, maxRedirects = 3): Promise<Response> {
+  let current = url;
+  for (let i = 0; i <= maxRedirects; i++) {
+    await assertPublicUrl(current);
+    const resp = await fetch(current, { ...init, redirect: 'manual' });
+    if (resp.status >= 300 && resp.status < 400) {
+      const loc = resp.headers.get('location');
+      if (!loc) return resp;
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    return resp;
+  }
+  throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/defi/dist/index.js

@@ -176,6 +176,21 @@ function parseAssetString(s) {
     const precision = dotIdx >= 0 ? parts[0].length - dotIdx - 1 : 0;
     return { amount, symbol: parts[1], precision };
 }
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: skills sign their own transactions, bypassing the runner's core
+// maxTransferAmount. Enforce the same XPR ceiling on any XPR the agent SENDS
+// (swaps/deposits/liquidity). MAX_TRANSFER_XPR (default 1000, matching the core
+// default); raise it to allow larger trades.
+function assertXprWithinCap(amount, symbol, label) {
+    if ((symbol || '').toUpperCase() !== 'XPR')
+        return; // cap is XPR-denominated
+    const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+    if (!Number.isFinite(capXpr) || capXpr <= 0)
+        return; // disabled/invalid -> no cap
+    if (Number.isFinite(amount) && amount > capXpr) {
+        throw new Error(`${label}: ${amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+    }
+}
 // ── Session Factory ──────────────────────────────
 // Backed by the proton CLI. The agent process never holds a private key —
 // the CLI signs every transaction internally via its encrypted keychain.
@@ -781,6 +796,7 @@ function defiSkill(api) {
                     depositQuantity = formatAsset(params.amount, bidToken.precision, bidToken.code);
                     depositContract = bidToken.contract;
                 }
+                assertXprWithinCap(orderSide === 1 ? params.amount * params.price : params.amount, orderSide === 1 ? askToken.code : bidToken.code, 'defi_place_order');
                 const { api: eosApi, account, permission } = await getSession();
                 const actions = [
                     // 1. Deposit tokens to DEX
@@ -926,6 +942,7 @@ function defiSkill(api) {
             if (!params.min_output || params.min_output <= 0)
                 return { error: 'min_output must be positive' };
             try {
+                assertXprWithinCap(params.amount, fromSpec.symbol, 'defi_swap');
                 const { api: eosApi, account, permission } = await getSession();
                 const fromQty = formatAsset(params.amount, fromSpec.precision, fromSpec.symbol);
                 const minOutQty = formatAsset(params.min_output, toSpec.precision, toSpec.symbol);
@@ -1010,6 +1027,8 @@ function defiSkill(api) {
             if (!params.token2_contract)
                 return { error: 'token2_contract is required' };
             try {
+                assertXprWithinCap(t1.amount, t1.symbol, 'defi_add_liquidity');
+                assertXprWithinCap(t2.amount, t2.symbol, 'defi_add_liquidity');
                 const { api: eosApi, account, permission } = await getSession();
                 const slip = (params.slippage_pct || 1.0) / 100;
                 const min1 = formatAsset(t1.amount * (1 - slip), t1.precision, t1.symbol);

package/skills/defi/src/index.ts

@@ -168,6 +168,20 @@ function parseAssetString(s: string): { amount: number; symbol: string; precisio
   return { amount, symbol: parts[1], precision };
 }
 
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: skills sign their own transactions, bypassing the runner's core
+// maxTransferAmount. Enforce the same XPR ceiling on any XPR the agent SENDS
+// (swaps/deposits/liquidity). MAX_TRANSFER_XPR (default 1000, matching the core
+// default); raise it to allow larger trades.
+function assertXprWithinCap(amount: number, symbol: string, label: string): void {
+  if ((symbol || '').toUpperCase() !== 'XPR') return; // cap is XPR-denominated
+  const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+  if (!Number.isFinite(capXpr) || capXpr <= 0) return; // disabled/invalid -> no cap
+  if (Number.isFinite(amount) && amount > capXpr) {
+    throw new Error(`${label}: ${amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+  }
+}
+
 // ── Session Factory ──────────────────────────────
 // Backed by the proton CLI. The agent process never holds a private key —
 // the CLI signs every transaction internally via its encrypted keychain.
@@ -790,6 +804,11 @@ export default function defiSkill(api: SkillApi): void {
           depositContract = bidToken.contract;
         }
 
+        assertXprWithinCap(
+          orderSide === 1 ? params.amount * params.price : params.amount,
+          orderSide === 1 ? askToken.code : bidToken.code,
+          'defi_place_order',
+        );
         const { api: eosApi, account, permission } = await getSession();
 
         const actions: any[] = [
@@ -933,6 +952,7 @@ export default function defiSkill(api: SkillApi): void {
       if (!params.min_output || params.min_output <= 0) return { error: 'min_output must be positive' };
 
       try {
+        assertXprWithinCap(params.amount, fromSpec.symbol, 'defi_swap');
         const { api: eosApi, account, permission } = await getSession();
 
         const fromQty = formatAsset(params.amount, fromSpec.precision, fromSpec.symbol);
@@ -1020,6 +1040,8 @@ export default function defiSkill(api: SkillApi): void {
       if (!params.token2_contract) return { error: 'token2_contract is required' };
 
       try {
+        assertXprWithinCap(t1.amount, t1.symbol, 'defi_add_liquidity');
+        assertXprWithinCap(t2.amount, t2.symbol, 'defi_add_liquidity');
         const { api: eosApi, account, permission } = await getSession();
         const slip = (params.slippage_pct || 1.0) / 100;
         const min1 = formatAsset(t1.amount * (1 - slip), t1.precision, t1.symbol);

package/skills/defi/test-read.mjs

@@ -20,7 +20,7 @@ const mockApi = {
   getConfig() {
     return {
       network: 'mainnet',
-      rpcEndpoint: 'https://proton.eosusa.io',
+      rpcEndpoint: 'https://api.protonnz.com',
     };
   },
 };

package/skills/governance/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 const GOV_API = 'https://gov.api.xprnetwork.org/api/v1/proposals';
 const GOV = 'gov';
 

package/skills/lending/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 
 async function getTableRows(opts) {
   const resp = await fetch(`${RPC}/v1/chain/get_table_rows`, {

package/skills/nft/dist/index.js

@@ -247,6 +247,23 @@ function parsePrice(price) {
     const contract = getTokenContract(symbol);
     return { amount, symbol, precision, contract };
 }
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: the runner enforces maxTransferAmount on the CORE escrow/agent tools,
+// but skills sign their own transactions, so a prompt-injected NFT purchase/bid
+// could spend far more than the operator's cap. Enforce the same ceiling here on
+// any XPR the agent SENDS. Cap is XPR-denominated via MAX_TRANSFER_XPR (default
+// 1000, matching the core default); set it higher to allow larger trades.
+function assertXprWithinCap(parsed, label) {
+    if (parsed.symbol !== 'XPR')
+        return; // cap is XPR-denominated
+    const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+    if (!Number.isFinite(capXpr) || capXpr <= 0)
+        return; // disabled/invalid -> no cap
+    const amt = Number(parsed.amount);
+    if (Number.isFinite(amt) && amt > capXpr) {
+        throw new Error(`${label}: ${parsed.amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+    }
+}
 // ── Validation Helpers ───────────────────────────
 function isValidEosioName(name) {
     if (!name || name.length > 12)
@@ -1301,6 +1318,7 @@ function nftSkill(api) {
                 return { error: 'price is required (must match listing price exactly)' };
             try {
                 const parsed = parsePrice(price);
+                assertXprWithinCap(parsed, 'nft_purchase');
                 const session = await getNftSession();
                 await ensureRam(session);
                 const result = await session.api.transact({
@@ -1427,6 +1445,7 @@ function nftSkill(api) {
                 return { error: 'bid_amount is required (e.g. "50.0000 XPR")' };
             try {
                 const parsed = parsePrice(bid_amount);
+                assertXprWithinCap(parsed, 'nft_bid');
                 const session = await getNftSession();
                 await ensureRam(session);
                 const result = await session.api.transact({

package/skills/nft/src/index.ts

@@ -248,6 +248,22 @@ function parsePrice(price: string): { amount: string; symbol: string; precision:
   return { amount, symbol, precision, contract };
 }
 
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: the runner enforces maxTransferAmount on the CORE escrow/agent tools,
+// but skills sign their own transactions, so a prompt-injected NFT purchase/bid
+// could spend far more than the operator's cap. Enforce the same ceiling here on
+// any XPR the agent SENDS. Cap is XPR-denominated via MAX_TRANSFER_XPR (default
+// 1000, matching the core default); set it higher to allow larger trades.
+function assertXprWithinCap(parsed: { amount: string; symbol: string }, label: string): void {
+  if (parsed.symbol !== 'XPR') return; // cap is XPR-denominated
+  const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+  if (!Number.isFinite(capXpr) || capXpr <= 0) return; // disabled/invalid -> no cap
+  const amt = Number(parsed.amount);
+  if (Number.isFinite(amt) && amt > capXpr) {
+    throw new Error(`${label}: ${parsed.amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+  }
+}
+
 // ── Validation Helpers ───────────────────────────
 
 function isValidEosioName(name: string): boolean {
@@ -1313,6 +1329,7 @@ export default function nftSkill(api: SkillApi): void {
 
       try {
         const parsed = parsePrice(price);
+        assertXprWithinCap(parsed, 'nft_purchase');
         const session = await getNftSession();
         await ensureRam(session);
 
@@ -1443,6 +1460,7 @@ export default function nftSkill(api: SkillApi): void {
 
       try {
         const parsed = parsePrice(bid_amount);
+        assertXprWithinCap(parsed, 'nft_bid');
         const session = await getNftSession();
         await ensureRam(session);
 

package/skills/web-scraping/dist/index.js

@@ -6,6 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = webScrapingSkill;
+const ssrf_1 = require("./ssrf");
 // ── Constants ───────────────────────────────────
 const MAX_BODY_SIZE = 5 * 1024 * 1024; // 5MB
 const DEFAULT_TIMEOUT = 30000;
@@ -15,9 +16,10 @@ async function fetchPage(url, timeout = DEFAULT_TIMEOUT, headers) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
     try {
-        const resp = await fetch(url, {
+        // guardedFetch resolves the host and refuses private/internal targets, and
+        // re-validates every redirect hop (SSRF: the URL is agent/job-controlled).
+        const resp = await (0, ssrf_1.guardedFetch)(url, {
             signal: controller.signal,
-            redirect: 'follow',
             headers: {
                 'User-Agent': USER_AGENT,
                 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

package/skills/web-scraping/dist/ssrf.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = isPrivateAddress;
+exports.assertPublicUrl = assertPublicUrl;
+exports.guardedFetch = guardedFetch;
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+function isPrivateAddress(ip) {
+    const v = (0, node_net_1.isIP)(ip);
+    if (v === 4) {
+        const p = ip.split('.').map(Number);
+        if (p.length !== 4 || p.some(n => Number.isNaN(n)))
+            return true;
+        const [a, b, c] = p;
+        return (a === 0 || a === 10 || a === 127 ||
+            (a === 169 && b === 254) || // link-local + cloud metadata
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 192 && b === 0 && c === 0) || // 192.0.0.0/24 (IETF protocol assignments)
+            (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 (benchmarking)
+            (a === 100 && b >= 64 && b <= 127) || // CGNAT
+            a >= 224 // multicast / reserved
+        );
+    }
+    if (v === 6) {
+        const s = ip.toLowerCase();
+        return (s === '::1' || s === '::' ||
+            s.startsWith('::ffff:') || // IPv4-mapped
+            s.startsWith('64:ff9b') || // NAT64 well-known prefix
+            /^fe[89a-f]/.test(s) || // link-local fe80::/10 + site-local fec0::/10
+            s.startsWith('fc') || s.startsWith('fd') // unique-local
+        );
+    }
+    return true;
+}
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+async function assertPublicUrl(urlStr) {
+    let host;
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+        }
+        host = u.hostname;
+    }
+    catch (e) {
+        throw new Error(`Blocked invalid URL: ${e.message}`);
+    }
+    if ((0, node_net_1.isIP)(host)) {
+        if (isPrivateAddress(host))
+            throw new Error(`Blocked private address: ${host}`);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await (0, promises_1.lookup)(host, { all: true });
+    }
+    catch {
+        throw new Error(`Blocked host that does not resolve: ${host}`);
+    }
+    if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+        throw new Error(`Blocked host resolving to a private address: ${host}`);
+    }
+}
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+async function guardedFetch(url, init = {}, maxRedirects = 3) {
+    let current = url;
+    for (let i = 0; i <= maxRedirects; i++) {
+        await assertPublicUrl(current);
+        const resp = await fetch(current, { ...init, redirect: 'manual' });
+        if (resp.status >= 300 && resp.status < 400) {
+            const loc = resp.headers.get('location');
+            if (!loc)
+                return resp;
+            current = new URL(loc, current).toString();
+            continue;
+        }
+        return resp;
+    }
+    throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/web-scraping/src/index.ts

@@ -4,6 +4,8 @@
  * Zero external dependencies — uses Node.js built-in fetch and regex-based HTML parsing.
  */
 
+import { guardedFetch } from './ssrf';
+
 interface ToolDef {
   name: string;
   description: string;
@@ -33,9 +35,10 @@ async function fetchPage(
   const timer = setTimeout(() => controller.abort(), timeout);
 
   try {
-    const resp = await fetch(url, {
+    // guardedFetch resolves the host and refuses private/internal targets, and
+    // re-validates every redirect hop (SSRF: the URL is agent/job-controlled).
+    const resp = await guardedFetch(url, {
       signal: controller.signal,
-      redirect: 'follow',
       headers: {
         'User-Agent': USER_AGENT,
         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

package/skills/web-scraping/src/ssrf.ts

@@ -0,0 +1,91 @@
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+export function isPrivateAddress(ip: string): boolean {
+  const v = isIP(ip);
+  if (v === 4) {
+    const p = ip.split('.').map(Number);
+    if (p.length !== 4 || p.some(n => Number.isNaN(n))) return true;
+    const [a, b, c] = p;
+    return (
+      a === 0 || a === 10 || a === 127 ||
+      (a === 169 && b === 254) ||               // link-local + cloud metadata
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 192 && b === 0 && c === 0) ||      // 192.0.0.0/24 (IETF protocol assignments)
+      (a === 198 && (b === 18 || b === 19)) ||  // 198.18.0.0/15 (benchmarking)
+      (a === 100 && b >= 64 && b <= 127) ||     // CGNAT
+      a >= 224                                    // multicast / reserved
+    );
+  }
+  if (v === 6) {
+    const s = ip.toLowerCase();
+    return (
+      s === '::1' || s === '::' ||
+      s.startsWith('::ffff:') ||                 // IPv4-mapped
+      s.startsWith('64:ff9b') ||                 // NAT64 well-known prefix
+      /^fe[89a-f]/.test(s) ||                    // link-local fe80::/10 + site-local fec0::/10
+      s.startsWith('fc') || s.startsWith('fd')   // unique-local
+    );
+  }
+  return true;
+}
+
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+export async function assertPublicUrl(urlStr: string): Promise<void> {
+  let host: string;
+  try {
+    const u = new URL(urlStr);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+      throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+    }
+    host = u.hostname;
+  } catch (e) {
+    throw new Error(`Blocked invalid URL: ${(e as Error).message}`);
+  }
+  if (isIP(host)) {
+    if (isPrivateAddress(host)) throw new Error(`Blocked private address: ${host}`);
+    return;
+  }
+  let addrs: { address: string }[];
+  try {
+    addrs = await lookup(host, { all: true });
+  } catch {
+    throw new Error(`Blocked host that does not resolve: ${host}`);
+  }
+  if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+    throw new Error(`Blocked host resolving to a private address: ${host}`);
+  }
+}
+
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+export async function guardedFetch(url: string, init: RequestInit = {}, maxRedirects = 3): Promise<Response> {
+  let current = url;
+  for (let i = 0; i <= maxRedirects; i++) {
+    await assertPublicUrl(current);
+    const resp = await fetch(current, { ...init, redirect: 'manual' });
+    if (resp.status >= 300 && resp.status < 400) {
+      const loc = resp.headers.get('location');
+      if (!loc) return resp;
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    return resp;
+  }
+  throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/xmd/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 const XMD_TOKEN = 'xmd.token';
 const XMD_TREASURY = 'xmd.treasury';
 const ORACLE = 'oracles';