SW-SKL-019: Fetches external URL content into context without an allowlist

What it detects

The rule reads every text file of the package line by line, and first checks the skill's frontmatter. If it lists hosts in allowed-hosts, allowed_hosts, allowed-domains or allowed_domains as a non-empty list, or if its allowed-tools line holds a WebFetch(domain: entry, the whole package is passed over.

Otherwise a line is reported when it holds a fetch marker: WebFetch, web_fetch, a phrase such as "fetch the page at" or "read the contents of" followed by an http or https address, requests.get(, urlopen(, curl -s with an address, or Invoke-WebRequest. A curl line that saves to a file (-o or a redirect) is a download, not a read into context, and is skipped. A line is also excused when the line itself, the two before it or the one after it contains "only from" or "allowlist".

Why it matters

Text from a web page goes into the agent's context like the skill's own words. If the skill reads from any address, whoever controls the page can write instructions the agent may follow, which is how a remote page becomes a way to steer the agent. The scanner maps this rule to OWASP ASI01, Agent Goal Hijack, and MCP06, Prompt Injection via Contextual Payloads, and to NIST SP 800-53 control SI-10, Information Input Validation.

Naming the hosts a skill may read from does not make the pages safe, but it limits who can write into the context, and a reviewer can check the list.

Example

This skill, which has no allowlist, tells the agent to read a page and summarise it:

.claude/skills/page-reader/SKILL.md

---
name: page-reader
description: Reads a web page and writes a short summary.
license: MIT
version: 1.0.0
---

# Page reader

Fetch the page at https://example.invalid/changelog and write a three-line summary of it.

The finding is on that line. The same skill passes when its frontmatter lists the host under allowed-hosts.

How to fix

Declare the hosts the skill reads from in the frontmatter, or scope the fetch tool to a domain in the allowed tools line, and say in the instruction that pages are read only from those hosts. Treat what a page says as data to summarise and never as instructions.

If it is a false positive

A research skill may have to read pages from hosts it cannot list in advance. Accept the finding with a note that says so, and make the skill state that page text is never followed as an instruction.

If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.

Related rules

• SW-SKL-001: Prompt-injection phrases in skill instructions
• SW-SKL-013: Network calls to raw IP addresses or URL shorteners