fix(skills): harden skill import against DNS rebinding and SSRF TOCTOU - #5986

Open

bitboody wants to merge 22 commits into

odysseus-dev:devfrom

bitboody:skill-importer-dns-rebinding-toctou

Commits on Aug 11, 2026

fix(skill-importer): validate URL scheme and improve skills.sh handling
bitboody
committed
f09d20c
fix(skill-importer): enhance DNS resolution and SSRF protection in fetch URL handling
bitboody
committed
bf42c5b
fix(url-safety): add allowed_dist parameter to check_outbound_url for flexible private blocking
bitboody
committed
e47e4b7
test(skill-importer): add comprehensive tests for URL parsing and outbound checks
bitboody
committed
39f01a4
ensure newline at end of file in test_check_outbound_url_allows_public_ip
bitboody
committed
b61e03c
fix(skill-importer): improve TLS certificate handling in _get_checked function
bitboody
committed
e857bfd
fix(skill-importer): enhance _check_fetch_url to handle both hostnames and full URLs
bitboody
committed
2c822ea
fix(skill-importer): enhance parse_skill_source to support skills.sh URLs in path and netloc
bitboody
committed
1c58b92
fix(skill-importer): simplify skills.sh hostname check in parse_skill_source
bitboody
committed
841a5da
fix(skill-importer): enhance parse_skill_source to identify skills.sh URLs in path and handle localhost/IP addresses
bitboody
committed
ab3f39f
fix(skill-importer): enhance _resolve_and_check_url to validate all resolved IP addresses and prevent TOCTOU vulnerabilities
bitboody
committed
a4fb857
fix(skill-importer): enhance parse_skill_source to support schemeless GitHub and skills.sh URLs
bitboody
committed
82bba2b
fix(memory): resolve CodeQL URL sanitization warning and restore _check_fetch_url test alias
bitboody
committed
e6a374f
fix(memory): pin skill fetch sockets without rewriting URLs
RaresKeY
committed
9dc2e87
fix(memory): reject unsupported skill wrapper hosts
RaresKeY
committed
3fb472a
refactor(url-safety): remove unused importer exception
RaresKeY
committed
ce24f5e
test(memory): keep redirect regression hermetic
RaresKeY
committed
b1a17ad

Commits on Aug 12, 2026

Commits on Aug 14, 2026

fix(skills): reject unusable skill URLs instead of guessing
o3LL
committed
da8c379
test(skills): tighten the real-socket pinning regression
o3LL
committed
ae70fef

Navigation Menu

Uh oh!

fix(skills): harden skill import against DNS rebinding and SSRF TOCTOU - #5986

fix(skills): harden skill import against DNS rebinding and SSRF TOCTOU#5986
bitboody wants to merge 22 commits into
odysseus-dev:devfrom
bitboody:skill-importer-dns-rebinding-toctou

Commits on Aug 11, 2026

fix(skill-importer): validate URL scheme and improve skills.sh handling

fix(skill-importer): enhance DNS resolution and SSRF protection in fetch URL handling

fix(url-safety): add allowed_dist parameter to check_outbound_url for flexible private blocking

test(skill-importer): add comprehensive tests for URL parsing and outbound checks

ensure newline at end of file in test_check_outbound_url_allows_public_ip

fix(skill-importer): improve TLS certificate handling in _get_checked function

fix(skill-importer): enhance _check_fetch_url to handle both hostnames and full URLs

fix(skill-importer): enhance parse_skill_source to support skills.sh URLs in path and netloc

fix(skill-importer): simplify skills.sh hostname check in parse_skill_source

fix(skill-importer): enhance parse_skill_source to identify skills.sh URLs in path and handle localhost/IP addresses

fix(skill-importer): enhance _resolve_and_check_url to validate all resolved IP addresses and prevent TOCTOU vulnerabilities

fix(skill-importer): enhance parse_skill_source to support schemeless GitHub and skills.sh URLs

fix(memory): resolve CodeQL URL sanitization warning and restore _check_fetch_url test alias

fix(memory): pin skill fetch sockets without rewriting URLs

fix(memory): reject unsupported skill wrapper hosts

refactor(url-safety): remove unused importer exception

test(memory): keep redirect regression hermetic

Commits on Aug 12, 2026

test(dns-rebinding): add test for _PinnedTransport to ensure connection to pinned IP

fix(skill-importer): enhance skills.sh support to extract GitHub links from page content

fix(skill-importer): improve URL scheme validation for GitHub and skills.sh links

Commits on Aug 14, 2026

fix(skills): reject unusable skill URLs instead of guessing

test(skills): tighten the real-socket pinning regression