@xpr-agents/openclaw 0.8.1 → 0.8.2

package/skills/nft/dist/index.js

@@ -247,6 +247,23 @@ function parsePrice(price) {
     const contract = getTokenContract(symbol);
     return { amount, symbol, precision, contract };
 }
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: the runner enforces maxTransferAmount on the CORE escrow/agent tools,
+// but skills sign their own transactions, so a prompt-injected NFT purchase/bid
+// could spend far more than the operator's cap. Enforce the same ceiling here on
+// any XPR the agent SENDS. Cap is XPR-denominated via MAX_TRANSFER_XPR (default
+// 1000, matching the core default); set it higher to allow larger trades.
+function assertXprWithinCap(parsed, label) {
+    if (parsed.symbol !== 'XPR')
+        return; // cap is XPR-denominated
+    const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+    if (!Number.isFinite(capXpr) || capXpr <= 0)
+        return; // disabled/invalid -> no cap
+    const amt = Number(parsed.amount);
+    if (Number.isFinite(amt) && amt > capXpr) {
+        throw new Error(`${label}: ${parsed.amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+    }
+}
 // ── Validation Helpers ───────────────────────────
 function isValidEosioName(name) {
     if (!name || name.length > 12)
@@ -1301,6 +1318,7 @@ function nftSkill(api) {
                 return { error: 'price is required (must match listing price exactly)' };
             try {
                 const parsed = parsePrice(price);
+                assertXprWithinCap(parsed, 'nft_purchase');
                 const session = await getNftSession();
                 await ensureRam(session);
                 const result = await session.api.transact({
@@ -1427,6 +1445,7 @@ function nftSkill(api) {
                 return { error: 'bid_amount is required (e.g. "50.0000 XPR")' };
             try {
                 const parsed = parsePrice(bid_amount);
+                assertXprWithinCap(parsed, 'nft_bid');
                 const session = await getNftSession();
                 await ensureRam(session);
                 const result = await session.api.transact({

package/skills/nft/src/index.ts

@@ -248,6 +248,22 @@ function parsePrice(price: string): { amount: string; symbol: string; precision:
   return { amount, symbol, precision, contract };
 }
 
+// ── Transfer cap ─────────────────────────────────
+// SECURITY: the runner enforces maxTransferAmount on the CORE escrow/agent tools,
+// but skills sign their own transactions, so a prompt-injected NFT purchase/bid
+// could spend far more than the operator's cap. Enforce the same ceiling here on
+// any XPR the agent SENDS. Cap is XPR-denominated via MAX_TRANSFER_XPR (default
+// 1000, matching the core default); set it higher to allow larger trades.
+function assertXprWithinCap(parsed: { amount: string; symbol: string }, label: string): void {
+  if (parsed.symbol !== 'XPR') return; // cap is XPR-denominated
+  const capXpr = Number(process.env.MAX_TRANSFER_XPR || '1000');
+  if (!Number.isFinite(capXpr) || capXpr <= 0) return; // disabled/invalid -> no cap
+  const amt = Number(parsed.amount);
+  if (Number.isFinite(amt) && amt > capXpr) {
+    throw new Error(`${label}: ${parsed.amount} XPR exceeds the transfer cap of ${capXpr} XPR (set MAX_TRANSFER_XPR to raise it).`);
+  }
+}
+
 // ── Validation Helpers ───────────────────────────
 
 function isValidEosioName(name: string): boolean {
@@ -1313,6 +1329,7 @@ export default function nftSkill(api: SkillApi): void {
 
       try {
         const parsed = parsePrice(price);
+        assertXprWithinCap(parsed, 'nft_purchase');
         const session = await getNftSession();
         await ensureRam(session);
 
@@ -1443,6 +1460,7 @@ export default function nftSkill(api: SkillApi): void {
 
       try {
         const parsed = parsePrice(bid_amount);
+        assertXprWithinCap(parsed, 'nft_bid');
         const session = await getNftSession();
         await ensureRam(session);
 

package/skills/web-scraping/dist/index.js

@@ -6,6 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = webScrapingSkill;
+const ssrf_1 = require("./ssrf");
 // ── Constants ───────────────────────────────────
 const MAX_BODY_SIZE = 5 * 1024 * 1024; // 5MB
 const DEFAULT_TIMEOUT = 30000;
@@ -15,9 +16,10 @@ async function fetchPage(url, timeout = DEFAULT_TIMEOUT, headers) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
     try {
-        const resp = await fetch(url, {
+        // guardedFetch resolves the host and refuses private/internal targets, and
+        // re-validates every redirect hop (SSRF: the URL is agent/job-controlled).
+        const resp = await (0, ssrf_1.guardedFetch)(url, {
             signal: controller.signal,
-            redirect: 'follow',
             headers: {
                 'User-Agent': USER_AGENT,
                 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

package/skills/web-scraping/dist/ssrf.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = isPrivateAddress;
+exports.assertPublicUrl = assertPublicUrl;
+exports.guardedFetch = guardedFetch;
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+function isPrivateAddress(ip) {
+    const v = (0, node_net_1.isIP)(ip);
+    if (v === 4) {
+        const p = ip.split('.').map(Number);
+        if (p.length !== 4 || p.some(n => Number.isNaN(n)))
+            return true;
+        const [a, b, c] = p;
+        return (a === 0 || a === 10 || a === 127 ||
+            (a === 169 && b === 254) || // link-local + cloud metadata
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 192 && b === 0 && c === 0) || // 192.0.0.0/24 (IETF protocol assignments)
+            (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 (benchmarking)
+            (a === 100 && b >= 64 && b <= 127) || // CGNAT
+            a >= 224 // multicast / reserved
+        );
+    }
+    if (v === 6) {
+        const s = ip.toLowerCase();
+        return (s === '::1' || s === '::' ||
+            s.startsWith('::ffff:') || // IPv4-mapped
+            s.startsWith('64:ff9b') || // NAT64 well-known prefix
+            /^fe[89a-f]/.test(s) || // link-local fe80::/10 + site-local fec0::/10
+            s.startsWith('fc') || s.startsWith('fd') // unique-local
+        );
+    }
+    return true;
+}
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+async function assertPublicUrl(urlStr) {
+    let host;
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+        }
+        host = u.hostname;
+    }
+    catch (e) {
+        throw new Error(`Blocked invalid URL: ${e.message}`);
+    }
+    if ((0, node_net_1.isIP)(host)) {
+        if (isPrivateAddress(host))
+            throw new Error(`Blocked private address: ${host}`);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await (0, promises_1.lookup)(host, { all: true });
+    }
+    catch {
+        throw new Error(`Blocked host that does not resolve: ${host}`);
+    }
+    if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+        throw new Error(`Blocked host resolving to a private address: ${host}`);
+    }
+}
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+async function guardedFetch(url, init = {}, maxRedirects = 3) {
+    let current = url;
+    for (let i = 0; i <= maxRedirects; i++) {
+        await assertPublicUrl(current);
+        const resp = await fetch(current, { ...init, redirect: 'manual' });
+        if (resp.status >= 300 && resp.status < 400) {
+            const loc = resp.headers.get('location');
+            if (!loc)
+                return resp;
+            current = new URL(loc, current).toString();
+            continue;
+        }
+        return resp;
+    }
+    throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/web-scraping/src/index.ts

@@ -4,6 +4,8 @@
  * Zero external dependencies — uses Node.js built-in fetch and regex-based HTML parsing.
  */
 
+import { guardedFetch } from './ssrf';
+
 interface ToolDef {
   name: string;
   description: string;
@@ -33,9 +35,10 @@ async function fetchPage(
   const timer = setTimeout(() => controller.abort(), timeout);
 
   try {
-    const resp = await fetch(url, {
+    // guardedFetch resolves the host and refuses private/internal targets, and
+    // re-validates every redirect hop (SSRF: the URL is agent/job-controlled).
+    const resp = await guardedFetch(url, {
       signal: controller.signal,
-      redirect: 'follow',
       headers: {
         'User-Agent': USER_AGENT,
         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

package/skills/web-scraping/src/ssrf.ts

@@ -0,0 +1,91 @@
+/**
+ * SSRF guard for skill fetches.
+ *
+ * These fetches are steered by agent/job-controlled URLs, and the runner sits
+ * inside a private network with cloud metadata and internal services reachable.
+ * Resolve the host and refuse any loopback / private / link-local / ULA / CGNAT /
+ * metadata address, and follow redirects MANUALLY so a public host that
+ * 3xx-redirects to an internal one is re-validated at every hop.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/** True for loopback, private, link-local, ULA, CGNAT, multicast and unparseable addresses. */
+export function isPrivateAddress(ip: string): boolean {
+  const v = isIP(ip);
+  if (v === 4) {
+    const p = ip.split('.').map(Number);
+    if (p.length !== 4 || p.some(n => Number.isNaN(n))) return true;
+    const [a, b, c] = p;
+    return (
+      a === 0 || a === 10 || a === 127 ||
+      (a === 169 && b === 254) ||               // link-local + cloud metadata
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 192 && b === 0 && c === 0) ||      // 192.0.0.0/24 (IETF protocol assignments)
+      (a === 198 && (b === 18 || b === 19)) ||  // 198.18.0.0/15 (benchmarking)
+      (a === 100 && b >= 64 && b <= 127) ||     // CGNAT
+      a >= 224                                    // multicast / reserved
+    );
+  }
+  if (v === 6) {
+    const s = ip.toLowerCase();
+    return (
+      s === '::1' || s === '::' ||
+      s.startsWith('::ffff:') ||                 // IPv4-mapped
+      s.startsWith('64:ff9b') ||                 // NAT64 well-known prefix
+      /^fe[89a-f]/.test(s) ||                    // link-local fe80::/10 + site-local fec0::/10
+      s.startsWith('fc') || s.startsWith('fd')   // unique-local
+    );
+  }
+  return true;
+}
+
+/** Resolve a URL's host and throw unless every address it maps to is public http(s). */
+export async function assertPublicUrl(urlStr: string): Promise<void> {
+  let host: string;
+  try {
+    const u = new URL(urlStr);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+      throw new Error(`Blocked non-http(s) URL: ${u.protocol}`);
+    }
+    host = u.hostname;
+  } catch (e) {
+    throw new Error(`Blocked invalid URL: ${(e as Error).message}`);
+  }
+  if (isIP(host)) {
+    if (isPrivateAddress(host)) throw new Error(`Blocked private address: ${host}`);
+    return;
+  }
+  let addrs: { address: string }[];
+  try {
+    addrs = await lookup(host, { all: true });
+  } catch {
+    throw new Error(`Blocked host that does not resolve: ${host}`);
+  }
+  if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+    throw new Error(`Blocked host resolving to a private address: ${host}`);
+  }
+}
+
+/**
+ * fetch() with an SSRF guard on every hop. Redirects are followed manually (up to
+ * maxRedirects) so each Location is re-validated — a public host cannot 302 to an
+ * internal one. Throws if a hop targets a private address or the redirect chain is
+ * too long.
+ */
+export async function guardedFetch(url: string, init: RequestInit = {}, maxRedirects = 3): Promise<Response> {
+  let current = url;
+  for (let i = 0; i <= maxRedirects; i++) {
+    await assertPublicUrl(current);
+    const resp = await fetch(current, { ...init, redirect: 'manual' });
+    if (resp.status >= 300 && resp.status < 400) {
+      const loc = resp.headers.get('location');
+      if (!loc) return resp;
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    return resp;
+  }
+  throw new Error(`Too many redirects (>${maxRedirects})`);
+}

package/skills/xmd/test-read.mjs

@@ -5,7 +5,7 @@
  * Usage: node test-read.mjs
  */
 
-const RPC = 'https://proton.eosusa.io';
+const RPC = 'https://api.protonnz.com';
 const XMD_TOKEN = 'xmd.token';
 const XMD_TREASURY = 'xmd.treasury';
 const ORACLE = 'oracles';