SW-SKL-013: Network calls to raw IP addresses or URL shorteners
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI10 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SC-7 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
The rule reads every text file of the package line by line and takes the host of every URL that starts with http or https. It reads the host as a browser or curl would: it drops anything before an at sign (so a trusted name before an at sign does not hide the real host after it), drops the port and a trailing dot, folds full-width characters and ideographic full stops to ASCII, decodes percent escapes, and treats a backslash as the end of the host in one reading and not in the other, checking both.
A line is reported when a host is a link shortener (bit.ly, tinyurl.com, t.co, goo.gl, is.gd and the rest of the fixed list, with or without a leading www) or an IP address, including the short, octal and hexadecimal forms that clients accept, such as 127.1 or 2130706433. Loopback and the unspecified address are skipped, as are the three IPv4 documentation ranges (192.0.2.0, 198.51.100.0 and 203.0.113.0) and the IPv6 documentation range. Link-local addresses are not skipped, because 169.254.169.254 is the cloud metadata endpoint.
Why it matters
A domain name says who runs a server and can be checked. A raw address says nothing, and a shortener hides the real destination until the link is followed, which is why both are used to point a skill at a payload or a collection point that a reviewer cannot judge. The scanner maps this rule to OWASP ASI10, Rogue Agents, and to NIST SP 800-53 control SC-7, Boundary Protection.
Example
This skill mentions a mirror at an IP address. The address is in a range reserved for network benchmarking, not one of the documentation ranges that the rule skips:
.claude/skills/data-fetcher/SKILL.md
---
name: data-fetcher
description: Loads sample data for a demo.
license: MIT
version: 1.0.0
---
# Data fetcher
The sample data is kept on a mirror at http://198.18.0.7/sample.json and is refreshed daily.The finding is on that line, and the evidence is the line.
How to fix
Use the real host name of the service, with https, so a reviewer can see who runs it and the certificate can be checked. Replace a shortened link with the address it points to.
If it is a false positive
A skill for network engineers, or one that talks to a device on a private address, names IP addresses on purpose. Accept the finding with a note that says what the address is, or use a documentation range for examples so the rule stays quiet.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.