@xpr-agents/openclaw 0.8.1 → 0.8.2

package/skills/code-sandbox/src/index.ts

@@ -25,61 +25,79 @@ const MAX_TIMEOUT = 30000;
 const MAX_OUTPUT_SIZE = 10 * 1024 * 1024; // 10MB
 
 // ── Sandbox helpers ─────────────────────────────
+//
+// SECURITY: the context is given ONLY primitive strings — never a host function or
+// object. That is the whole game with node:vm. `codeGeneration.strings:false` only
+// disables eval/Function *for this context's own realm*; a host closure handed in
+// (a console mock, atob/btoa via Buffer, anything) exposes `fn.constructor` — the
+// HOST realm's Function, where code generation is still allowed — so
+// `console.log.constructor("return process.env")()` would read the runner's secrets
+// and `Object.getPrototypeOf(hostFn).constructor.prototype` would pollute the host.
+// So: console, atob/btoa, INPUT parsing and the *result serialization* all run as
+// sandbox-realm code (below). Serializing inside the sandbox also keeps it under the
+// execution timeout — a malicious getter can no longer stall the host via a
+// host-side JSON.stringify. The only value read back out is a JSON string (a
+// primitive), which the host then parses safely.
+
+/** Sandbox-realm preamble: pure-JS console/atob/btoa/INPUT, no host references. */
+const SANDBOX_PREAMBLE = `
+var __logs = [];
+var console = {
+  log: function(){ __logs.push(Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  warn: function(){ __logs.push('[warn] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); },
+  error: function(){ __logs.push('[error] ' + Array.prototype.map.call(arguments, function(a){ return typeof a === 'object' ? JSON.stringify(a) : String(a); }).join(' ')); }
+};
+var __B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function btoa(s){ s = String(s); var o = ''; for (var i = 0; i < s.length; ) {
+  var c1 = s.charCodeAt(i++), c2 = s.charCodeAt(i++), c3 = s.charCodeAt(i++);
+  var e1 = c1 >> 2, e2 = ((c1 & 3) << 4) | (c2 >> 4), e3 = ((c2 & 15) << 2) | (c3 >> 6), e4 = c3 & 63;
+  if (isNaN(c2)) { e3 = e4 = 64; } else if (isNaN(c3)) { e4 = 64; }
+  o += __B64.charAt(e1) + __B64.charAt(e2) + (e3 === 64 ? '=' : __B64.charAt(e3)) + (e4 === 64 ? '=' : __B64.charAt(e4));
+} return o; }
+function atob(s){ s = String(s).replace(/[^A-Za-z0-9+/=]/g, ''); var o = ''; for (var i = 0; i < s.length; ) {
+  var d1 = __B64.indexOf(s.charAt(i++)), d2 = __B64.indexOf(s.charAt(i++)), d3 = __B64.indexOf(s.charAt(i++)), d4 = __B64.indexOf(s.charAt(i++));
+  var c1 = (d1 << 2) | (d2 >> 4), c2 = ((d2 & 15) << 4) | (d3 >> 2), c3 = ((d3 & 3) << 6) | d4;
+  o += String.fromCharCode(c1); if (d3 !== 64 && d3 >= 0) o += String.fromCharCode(c2); if (d4 !== 64 && d4 >= 0) o += String.fromCharCode(c3);
+} return o; }
+`.trim();
 
-function createSandboxGlobals(input: unknown, logs: string[]): Record<string, unknown> {
-  // Capture console methods
-  const consoleMock = {
-    log: (...args: unknown[]) => {
-      logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-    warn: (...args: unknown[]) => {
-      logs.push('[warn] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-    error: (...args: unknown[]) => {
-      logs.push('[error] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
-    },
-  };
-
-  return {
-    INPUT: input,
-    console: consoleMock,
-    JSON,
-    Math,
-    Date,
-    Array,
-    Object,
-    String,
-    Number,
-    RegExp,
-    Map,
-    Set,
-    parseInt,
-    parseFloat,
-    isNaN,
-    isFinite,
-    encodeURIComponent,
-    decodeURIComponent,
-    atob: (s: string) => Buffer.from(s, 'base64').toString('binary'),
-    btoa: (s: string) => Buffer.from(s, 'binary').toString('base64'),
-    // Explicitly undefined — blocked
-    require: undefined,
-    process: undefined,
-    globalThis: undefined,
-    global: undefined,
-  };
-}
-
-function serializeResult(value: unknown): string {
-  if (value === undefined) return 'undefined';
-  try {
-    const str = JSON.stringify(value, null, 2);
-    if (str.length > MAX_OUTPUT_SIZE) {
-      return str.slice(0, MAX_OUTPUT_SIZE) + '\n... [truncated at 10MB]';
-    }
-    return str;
-  } catch {
-    return String(value);
-  }
+/**
+ * Run a self-contained expression/body in a fresh vm realm and return the parsed
+ * outcome. `body` must be a statement list whose LAST expression is the user value
+ * to capture. Everything is serialized to a JSON string inside the sandbox.
+ */
+function runInSandbox(
+  body: string,
+  timeoutMs: number,
+  inputJson: string | undefined,
+): { ok: boolean; result?: unknown; logs: string[]; error?: string; oversized?: boolean } {
+  // Only a primitive string crosses into the realm — AND the context global is
+  // given a NULL prototype. If we hand vm.createContext an ordinary host object,
+  // the sandbox global inherits the HOST realm's Object.prototype, so
+  // `this.constructor.constructor("return process.env")()` walks to the host
+  // Function (where codeGeneration is allowed) and reads the runner's secrets —
+  // codeGeneration:false only covers THIS context's realm. A null-proto global
+  // makes `this.constructor` resolve to the sandbox realm's own Function, which
+  // the flag then blocks. (Confirmed escape via the global-object path, 2026-09-19.)
+  const sandboxGlobal: Record<string, unknown> = Object.create(null);
+  sandboxGlobal.__INPUT_JSON = inputJson;
+  const context = vm.createContext(sandboxGlobal, {
+    codeGeneration: { strings: false, wasm: false },
+  });
+  const wrapped = `${SANDBOX_PREAMBLE}
+var INPUT = (typeof __INPUT_JSON === 'string') ? JSON.parse(__INPUT_JSON) : undefined;
+var __result, __error = null;
+try { __result = (function(){ ${body} \n})(); } catch (e) { __error = (e && e.message) ? String(e.message) : String(e); }
+(function(){
+  try { return JSON.stringify({ ok: __error === null, result: __result === undefined ? null : __result, logs: __logs, error: __error }); }
+  catch (e) { return JSON.stringify({ ok: __error === null, result: String(__result), logs: __logs, error: __error }); }
+})();`;
+  const script = new vm.Script(wrapped, { filename: 'sandbox.js' });
+  const out = script.runInContext(context, { timeout: timeoutMs }) as string;
+  if (typeof out !== 'string') return { ok: false, logs: [], error: 'sandbox produced no serializable output' };
+  if (out.length > MAX_OUTPUT_SIZE) return { ok: false, logs: [], error: 'Output exceeded 10MB limit', oversized: true };
+  const parsed = JSON.parse(out) as { ok: boolean; result?: unknown; logs: string[]; error?: string };
+  return parsed;
 }
 
 // ── Skill entry point ───────────────────────────
@@ -113,53 +131,41 @@ export default function codeSandboxSkill(api: SkillApi): void {
       }
 
       const timeoutMs = Math.min(Math.max(timeout || DEFAULT_TIMEOUT, 100), MAX_TIMEOUT);
-      const logs: string[] = [];
       const startTime = Date.now();
 
+      let inputJson: string | undefined;
       try {
-        const globals = createSandboxGlobals(input, logs);
-        const context = vm.createContext(globals, {
-          codeGeneration: { strings: false, wasm: false },
-        });
-
-        // Wrap code so the last expression is returned
-        const wrapped = `(function() {\n${code}\n})()`;
-        const script = new vm.Script(wrapped, { filename: 'sandbox.js' });
-        const result = script.runInContext(context, { timeout: timeoutMs });
-        const durationMs = Date.now() - startTime;
+        inputJson = input === undefined ? undefined : JSON.stringify(input);
+      } catch {
+        return { error: 'input could not be serialized to JSON' };
+      }
 
-        const serialized = serializeResult(result);
-        if (serialized.length > MAX_OUTPUT_SIZE) {
-          return {
-            result: serialized.slice(0, 1000) + '... [truncated]',
-            logs,
-            duration_ms: durationMs,
-            warning: 'Output exceeded 10MB limit and was truncated',
-          };
+      try {
+        const out = runInSandbox(code, timeoutMs, inputJson);
+        const durationMs = Date.now() - startTime;
+        if (out.oversized) {
+          return { error: 'Output exceeded 10MB limit', logs: out.logs, duration_ms: durationMs, warning: 'Output exceeded 10MB limit and was truncated' };
         }
-
-        // Parse back to preserve types (arrays, objects)
-        let parsed: unknown;
-        try {
-          parsed = JSON.parse(serialized);
-        } catch {
-          parsed = serialized === 'undefined' ? undefined : serialized;
+        if (!out.ok) {
+          const message = out.error || 'unknown error';
+          if (message.includes('Code generation from strings disallowed')) {
+            return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: out.logs, duration_ms: durationMs };
+          }
+          return { error: message, logs: out.logs, duration_ms: durationMs };
         }
-
-        return { result: parsed, logs, duration_ms: durationMs };
+        return { result: out.result, logs: out.logs, duration_ms: durationMs };
       } catch (err: any) {
         const durationMs = Date.now() - startTime;
         const message = err.message || String(err);
 
-        // Provide helpful error context
-        if (message.includes('Script execution timed out')) {
-          return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs, duration_ms: durationMs };
+        // Timeout is a hard interrupt thrown to the host, so it lands here.
+        if (message.includes('Script execution timed out') || message.includes('timed out')) {
+          return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs: [], duration_ms: durationMs };
         }
         if (message.includes('Code generation from strings disallowed')) {
-          return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs, duration_ms: durationMs };
+          return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs: [], duration_ms: durationMs };
         }
-
-        return { error: message, logs, duration_ms: durationMs };
+        return { error: message, logs: [], duration_ms: durationMs };
       }
     },
   });
@@ -185,27 +191,17 @@ export default function codeSandboxSkill(api: SkillApi): void {
       }
 
       try {
-        const globals = createSandboxGlobals(undefined, []);
-        const context = vm.createContext(globals, {
-          codeGeneration: { strings: false, wasm: false },
-        });
-
-        const script = new vm.Script(`(${expression})`, { filename: 'expr.js' });
-        const result = script.runInContext(context, { timeout: DEFAULT_TIMEOUT });
-
-        let serialized: unknown;
-        try {
-          serialized = JSON.parse(JSON.stringify(result));
-        } catch {
-          serialized = String(result);
-        }
-
-        return {
-          result: serialized,
-          type: result === null ? 'null' : Array.isArray(result) ? 'array' : typeof result,
-        };
+        // Evaluate as the returned value of the sandbox body (same isolated realm,
+        // in-sandbox serialization). The value comes back as parsed JSON.
+        const out = runInSandbox(`return (${expression});`, DEFAULT_TIMEOUT, undefined);
+        if (!out.ok) return { error: out.error || 'evaluation failed' };
+        const r = out.result;
+        const type = r === null ? 'null' : Array.isArray(r) ? 'array' : typeof r;
+        return { result: r, type };
       } catch (err: any) {
-        return { error: err.message || String(err) };
+        const message = err.message || String(err);
+        if (message.includes('timed out')) return { error: `Execution timed out after ${DEFAULT_TIMEOUT}ms.` };
+        return { error: message };
       }
     },
   });

package/skills/creative/dist/index.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDeliverable = getDeliverable;
 exports.default = creativeSkill;
+const ssrf_1 = require("./ssrf");
 // ── Shared helpers ──────────────────────────────
 const MAX_DELIVERABLES = 200;
 const deliverables = new Map();
@@ -121,7 +122,9 @@ async function downloadFromUrl(url) {
     if (!/^https?:\/\//.test(url))
         return null;
     try {
-        const resp = await fetch(url, { signal: AbortSignal.timeout(30000), redirect: 'follow' });
+        // SSRF: the URL is agent/job-controlled and this runs inside a private network.
+        // guardedFetch refuses private/internal targets and re-validates each redirect.
+        const resp = await (0, ssrf_1.guardedFetch)(url, { signal: AbortSignal.timeout(30000) });
         if (!resp.ok)
             return null;
         const contentType = resp.headers.get('content-type') || 'application/octet-stream';
@@ -156,7 +159,8 @@ function extractImages(text) {
 }
 async function downloadImage(url) {
     try {
-        const resp = await fetch(url, { signal: AbortSignal.timeout(15000) });
+        // SSRF: image URLs come from agent-authored markdown — guard + re-validate redirects.
+        const resp = await (0, ssrf_1.guardedFetch)(url, { signal: AbortSignal.timeout(15000) });
         if (!resp.ok)
             return null;
         const ct = (resp.headers.get('content-type') || '').split(';')[0].trim();

package/skills/creative/dist/ssrf.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = isPrivateAddress;
+exports.assertPublicUrl = assertPublicUrl;
+exports.guardedFetch = guardedFetch;
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+function isPrivateAddress(ip) {
+    const v = (0, node_net_1.isIP)(ip);
+    if (v === 4) {
+        const p = ip.split('.').map(Number);
+        if (p.length !== 4 || p.some(n => Number.isNaN(n)))
+            return true;
+        const [a, b, c] = p;
+        return (a === 0 || a === 10 || a === 127 ||
+            (a === 169 && b === 254) || // link-local + cloud metadata
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 192 && b === 0 && c === 0) || // 192.0.0.0/24 (IETF protocol assignments)
+            (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 (benchmarking)
+            (a === 100 && b >= 64 && b <= 127) || // CGNAT
+            a >= 224 // multicast / reserved
+        );
+    }
+    if (v === 6) {
+        const s = ip.toLowerCase();
+        return (s === '::1' || s === '::' ||
+            s.startsWith('::ffff:') || // IPv4-mapped
+            s.startsWith('64:ff9b') || // NAT64 well-known prefix
+            /^fe[89a-f]/.test(s) || // link-local fe80::/10 + site-local fec0::/10
+            s.startsWith('fc') || s.startsWith('fd') // unique-local
+        );
+    }
+    return true;
+}
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+async function assertPublicUrl(urlStr) {
+    let host;
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+        }
+        host = u.hostname;
+    }
+    catch (e) {
+        throw new Error(`Blocked invalid URL: ${e.message}`);
+    }
+    if ((0, node_net_1.isIP)(host)) {
+        if (isPrivateAddress(host))
+            throw new Error(`Blocked private address: ${host}`);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await (0, promises_1.lookup)(host, { all: true });
+    }
+    catch {
+        throw new Error(`Blocked host that does not resolve: ${host}`);
+    }
+    if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+        throw new Error(`Blocked host resolving to a private address: ${host}`);
+    }
+}
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+async function guardedFetch(url, init = {}, maxRedirects = 3) {
+    let current = url;
+    for (let i = 0; i <= maxRedirects; i++) {
+        await assertPublicUrl(current);
+        const resp = await fetch(current, { ...init, redirect: 'manual' });
+        if (resp.status >= 300 && resp.status < 400) {
+            const loc = resp.headers.get('location');
+            if (!loc)
+                return resp;
+            current = new URL(loc, current).toString();
+            continue;
+        }
+        return resp;
+    }
+    throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/creative/src/index.ts

@@ -5,6 +5,8 @@
  * Extracted from the main agent runner to validate the skill module format.
  */
 
+import { guardedFetch } from './ssrf';
+
 interface ToolDef {
   name: string;
   description: string;
@@ -132,7 +134,9 @@ const MAX_DOWNLOAD_SIZE = 50 * 1024 * 1024;
 async function downloadFromUrl(url: string): Promise<{ buffer: Buffer; mimeType: string } | null> {
   if (!/^https?:\/\//.test(url)) return null;
   try {
-    const resp = await fetch(url, { signal: AbortSignal.timeout(30000), redirect: 'follow' });
+    // SSRF: the URL is agent/job-controlled and this runs inside a private network.
+    // guardedFetch refuses private/internal targets and re-validates each redirect.
+    const resp = await guardedFetch(url, { signal: AbortSignal.timeout(30000) });
     if (!resp.ok) return null;
     const contentType = resp.headers.get('content-type') || 'application/octet-stream';
     const contentLength = parseInt(resp.headers.get('content-length') || '0');
@@ -161,7 +165,8 @@ function extractImages(text: string): { alt: string; url: string }[] {
 
 async function downloadImage(url: string): Promise<{ buffer: Buffer; type: string } | null> {
   try {
-    const resp = await fetch(url, { signal: AbortSignal.timeout(15000) });
+    // SSRF: image URLs come from agent-authored markdown — guard + re-validate redirects.
+    const resp = await guardedFetch(url, { signal: AbortSignal.timeout(15000) });
     if (!resp.ok) return null;
     const ct = (resp.headers.get('content-type') || '').split(';')[0].trim();
     if (!ct.startsWith('image/')) return null;

package/skills/creative/src/ssrf.ts

@@ -0,0 +1,91 @@
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+export function isPrivateAddress(ip: string): boolean {
+  const v = isIP(ip);
+  if (v === 4) {
+    const p = ip.split('.').map(Number);
+    if (p.length !== 4 || p.some(n => Number.isNaN(n))) return true;
+    const [a, b, c] = p;
+    return (
+      a === 0 || a === 10 || a === 127 ||
+      (a === 169 && b === 254) ||               // link-local + cloud metadata
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 192 && b === 0 && c === 0) ||      // 192.0.0.0/24 (IETF protocol assignments)
+      (a === 198 && (b === 18 || b === 19)) ||  // 198.18.0.0/15 (benchmarking)
+      (a === 100 && b >= 64 && b <= 127) ||     // CGNAT
+      a >= 224                                    // multicast / reserved
+    );
+  }
+  if (v === 6) {
+    const s = ip.toLowerCase();
+    return (
+      s === '::1' || s === '::' ||
+      s.startsWith('::ffff:') ||                 // IPv4-mapped
+      s.startsWith('64:ff9b') ||                 // NAT64 well-known prefix
+      /^fe[89a-f]/.test(s) ||                    // link-local fe80::/10 + site-local fec0::/10
+      s.startsWith('fc') || s.startsWith('fd')   // unique-local
+    );
+  }
+  return true;
+}
+
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+export async function assertPublicUrl(urlStr: string): Promise<void> {
+  let host: string;
+  try {
+    const u = new URL(urlStr);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+      throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+    }
+    host = u.hostname;
+  } catch (e) {
+    throw new Error(`Blocked invalid URL: ${(e as Error).message}`);
+  }
+  if (isIP(host)) {
+    if (isPrivateAddress(host)) throw new Error(`Blocked private address: ${host}`);
+    return;
+  }
+  let addrs: { address: string }[];
+  try {
+    addrs = await lookup(host, { all: true });
+  } catch {
+    throw new Error(`Blocked host that does not resolve: ${host}`);
+  }
+  if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+    throw new Error(`Blocked host resolving to a private address: ${host}`);
+  }
+}
+
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+export async function guardedFetch(url: string, init: RequestInit = {}, maxRedirects = 3): Promise<Response> {
+  let current = url;
+  for (let i = 0; i <= maxRedirects; i++) {
+    await assertPublicUrl(current);
+    const resp = await fetch(current, { ...init, redirect: 'manual' });
+    if (resp.status >= 300 && resp.status < 400) {
+      const loc = resp.headers.get('location');
+      if (!loc) return resp;
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    return resp;
+  }
+  throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/defi/dist/index.js

@@ -176,6 +176,21 @@ function parseAssetString(s) {
     const precision = dotIdx >= 0 ? parts[0].length - dotIdx - 1 : 0;
     return { amount, symbol: parts[1], precision };
 }
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: skills sign their own transactions, bypassing the runner's core
+// maxTransferAmount. Enforce the same XPR ceiling on any XPR the agent SENDS
+// (swaps/deposits/liquidity). MAX_TRANSFER_XPR (default 1000, matching the core
+// default); raise it to allow larger trades.
+function assertXprWithinCap(amount, symbol, label) {
+    if ((symbol || '').toUpperCase() !== 'XPR')
+        return; // cap is XPR-denominated
+    const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+    if (!Number.isFinite(capXpr) || capXpr <= 0)
+        return; // disabled/invalid -> no cap
+    if (Number.isFinite(amount) && amount > capXpr) {
+        throw new Error(`${label}: ${amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+    }
+}
 // ── Session Factory ──────────────────────────────
 // Backed by the proton CLI. The agent process never holds a private key —
 // the CLI signs every transaction internally via its encrypted keychain.
@@ -781,6 +796,7 @@ function defiSkill(api) {
                     depositQuantity = formatAsset(params.amount, bidToken.precision, bidToken.code);
                     depositContract = bidToken.contract;
                 }
+                assertXprWithinCap(orderSide === 1 ? params.amount * params.price : params.amount, orderSide === 1 ? askToken.code : bidToken.code, 'defi_place_order');
                 const { api: eosApi, account, permission } = await getSession();
                 const actions = [
                     // 1. Deposit tokens to DEX
@@ -926,6 +942,7 @@ function defiSkill(api) {
             if (!params.min_output || params.min_output <= 0)
                 return { error: 'min_output must be positive' };
             try {
+                assertXprWithinCap(params.amount, fromSpec.symbol, 'defi_swap');
                 const { api: eosApi, account, permission } = await getSession();
                 const fromQty = formatAsset(params.amount, fromSpec.precision, fromSpec.symbol);
                 const minOutQty = formatAsset(params.min_output, toSpec.precision, toSpec.symbol);
@@ -1010,6 +1027,8 @@ function defiSkill(api) {
             if (!params.token2_contract)
                 return { error: 'token2_contract is required' };
             try {
+                assertXprWithinCap(t1.amount, t1.symbol, 'defi_add_liquidity');
+                assertXprWithinCap(t2.amount, t2.symbol, 'defi_add_liquidity');
                 const { api: eosApi, account, permission } = await getSession();
                 const slip = (params.slippage_pct || 1.0) / 100;
                 const min1 = formatAsset(t1.amount * (1 - slip), t1.precision, t1.symbol);

package/skills/defi/src/index.ts

@@ -168,6 +168,20 @@ function parseAssetString(s: string): { amount: number; symbol: string; precisio
   return { amount, symbol: parts[1], precision };
 }
 
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: skills sign their own transactions, bypassing the runner's core
+// maxTransferAmount. Enforce the same XPR ceiling on any XPR the agent SENDS
+// (swaps/deposits/liquidity). MAX_TRANSFER_XPR (default 1000, matching the core
+// default); raise it to allow larger trades.
+function assertXprWithinCap(amount: number, symbol: string, label: string): void {
+  if ((symbol || '').toUpperCase() !== 'XPR') return; // cap is XPR-denominated
+  const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+  if (!Number.isFinite(capXpr) || capXpr <= 0) return; // disabled/invalid -> no cap
+  if (Number.isFinite(amount) && amount > capXpr) {
+    throw new Error(`${label}: ${amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+  }
+}
+
 // ── Session Factory ──────────────────────────────
 // Backed by the proton CLI. The agent process never holds a private key —
 // the CLI signs every transaction internally via its encrypted keychain.
@@ -790,6 +804,11 @@ export default function defiSkill(api: SkillApi): void {
           depositContract = bidToken.contract;
         }
 
+        assertXprWithinCap(
+          orderSide === 1 ? params.amount * params.price : params.amount,
+          orderSide === 1 ? askToken.code : bidToken.code,
+          'defi_place_order',
+        );
         const { api: eosApi, account, permission } = await getSession();
 
         const actions: any[] = [
@@ -933,6 +952,7 @@ export default function defiSkill(api: SkillApi): void {
       if (!params.min_output || params.min_output <= 0) return { error: 'min_output must be positive' };
 
       try {
+        assertXprWithinCap(params.amount, fromSpec.symbol, 'defi_swap');
         const { api: eosApi, account, permission } = await getSession();
 
         const fromQty = formatAsset(params.amount, fromSpec.precision, fromSpec.symbol);
@@ -1020,6 +1040,8 @@ export default function defiSkill(api: SkillApi): void {
       if (!params.token2_contract) return { error: 'token2_contract is required' };
 
       try {
+        assertXprWithinCap(t1.amount, t1.symbol, 'defi_add_liquidity');
+        assertXprWithinCap(t2.amount, t2.symbol, 'defi_add_liquidity');
         const { api: eosApi, account, permission } = await getSession();
         const slip = (params.slippage_pct || 1.0) / 100;
         const min1 = formatAsset(t1.amount * (1 - slip), t1.precision, t1.symbol);

package/skills/defi/test-read.mjs

@@ -20,7 +20,7 @@ const mockApi = {
   getConfig() {
     return {
       network: 'mainnet',
-      rpcEndpoint: 'https://proton.eosusa.io',
+      rpcEndpoint: 'https://api.protonnz.com',
     };
   },
 };

package/skills/governance/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 const GOV_API = 'https://gov.api.xprnetwork.org/api/v1/proposals';
 const GOV = 'gov';
 

package/skills/lending/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 
 async function getTableRows(opts) {
   const resp = await fetch(`${RPC}/v1/chain/get_table_rows`, {