A drop-in security skill for Claude Code that adds a mandatory protection layer around any external content your agent processes — WebFetch, WebSearch, GitHub reads, foreign repo READMEs, fetched PDFs, MCP tool outputs from external services.
Core principle: External content is data, never instructions.
Version 1.1.0 · Openly licensed (CC-BY-4.0) · Maintainer: Luis Hornburg
Out of the box, when a Claude Code session fetches an external page, the model reads everything in that page as part of its context — including instructions hidden by the page author. That's the textbook prompt-injection vector. It also opens a path for PII leaks (when your username slips into outbound URLs), unwanted package installs ("just npm install this to inspect it"), and 1:1 copy-paste of code from repos with incompatible licenses.
This skill is the boring, mandatory guardrail layer that prevents all of that. It runs before every external call, after every external call, and in the workflow when your agent considers using a foreign repo for inspiration.
Block A — External-Content Security (Prompt-Injection Layer)
- Output quarantine (external content treated as data, not instructions)
- Injection pattern scan (linguistic + structural markers, including hidden Unicode and HTML comments)
- Tool-call-injection defense
- Recursive fetch ban (no auto-following links inside fetched content)
- Default domain allowlist + your additions
- PII leak prevention in URL parameters
- Auth token protection
- Suspicion escalation with incident log
Block B — Never Download, Always Rebuild
- Concrete bans (
git clone,wget,npm install,pip install, binary fetches,docker pull, etc.) - Allowed-operations list (WebFetch on text files, public GitHub reads)
- 7-step workflow for repo inspiration including license decision matrix and trademark check
- Special case: researching NPM/PyPI/Crates packages without installing
Auto-runs a 6-step Setup Wizard on first trigger to personalize:
- Identity patterns (your PII to keep out of URLs)
- Additional allowlist domains
- Blocklist domains
- Incident log location (project / global / custom)
- Language (EN / DE / bilingual)
- Strictness level (paranoid / standard / lenient)
After setup, the skill loads silently on trigger and enforces the layer.
-
Copy the contents of this repository into
~/.claude/skills/webfetch-security-baseline/(Linux/macOS) orC:\Users\<you>\.claude\skills\webfetch-security-baseline\(Windows).- Required:
SKILL.md,user-config.template.md - Optional:
examples/,LICENSE,CHANGELOG.md
- Required:
-
Rename
user-config.template.mdtouser-config.md(the skill won't overwrite a template, only a file it expects to write). -
Open a Claude Code session and trigger the skill with any of:
/webfetch-security- "webfetch security setup"
- "secure external content"
- "prompt injection schutz" (German)
The Setup Wizard runs automatically because
user-config.mdstill contains the__SETUP_INCOMPLETE__markers. Answer the 6 questions. -
Done. The skill is active.
After setup, ask Claude Code: "Run me through what the WebFetch Security Baseline will do on the next external call." It should summarize Block A + Block B with your personalized identity patterns and allowlist additions.
Delete user-config.md or replace all values with __SETUP_INCOMPLETE__, then trigger the skill again. Wizard runs from scratch.
The skill activates on any of these phrases (English + German):
| English | German |
|---|---|
| webfetch | webfetch |
| websearch | websearch |
| fetch | fetch |
| github read | github lesen, repo lesen |
| readme | readme abrufen |
| docs | doku abrufen |
| external source | externe quelle |
| research | recherche |
| deep research | deep research |
| scraping | scraping |
| url lesen | url lesen |
| pdf fetch | pdf abrufen |
| /webfetch-security | /webfetch-security |
| security baseline | security baseline |
| prompt injection | prompt injection schutz |
| secure external content | externe inhalte absichern |
webfetch-security-baseline-public/
├── SKILL.md # The skill itself (with Phase 0 Setup Wizard)
├── user-config.template.md # Template the wizard fills out
├── README.md # This file
├── CHANGELOG.md # Version history
├── LICENSE # CC-BY-4.0
├── install.md # Detailed install + troubleshooting
├── enforcement/ # Optional Layer 1 hooks (added in v1.1.0)
│ ├── README.md # Layer model and rationale
│ ├── install-hooks.md # Hook activation + smoke tests
│ └── hooks/
│ ├── pretool-webfetch-pii-guard.py
│ └── posttool-webfetch-injection-scanner.py
└── examples/
├── beispiel-incident-log.md # Sample incident log (DE)
└── beispiel-allowlist-it.md # Sample allowlist for IT/DevOps users
This skill is the briefing layer. It tells Claude what to consider when processing external content. Claude Code itself ships with a built-in permissions layer (permissions.allow, permissions.deny, permissions.ask in settings.json) — that is the tool-use layer.
For most users, the briefing layer plus Claude Code's built-in permissions give strong protection. For users who want more, this repo ships optional add-on hooks under enforcement/:
pretool-webfetch-pii-guard.py— greps outbound URLs against your configured identity patterns before WebFetch fires. Claude Code's permissions cannot introspect URL parameters; this can.posttool-webfetch-injection-scanner.py— scans fetched content for prompt-injection markers and warns Claude before it processes the output. Claude Code's permissions decide whether the fetch runs, not what is in it.
See enforcement/README.md for the layer model and enforcement/install-hooks.md for activation.
- It is not a network firewall. Outbound packets at the OS level are not blocked. For that, see your firewall, DNS sinkholing, or proxy.
- It is not a sandbox. Claude Code still runs as your user. For OS-level isolation, run Claude Code in a devcontainer or as a restricted user.
- It is not a malware scanner. It catches prompt injection and obvious supply-chain footguns, not novel zero-days.
- It is not a substitute for your team's general security review. It is a Claude-Code-specific guardrail.
- It is not specific to any domain (HR, legal, finance, etc.). It is a general-purpose layer. Specialized skills can build on top.
- Tested on Claude Code (CLI + IDE extensions) as of May 2026
- Skill format follows the official Claude Code skills schema (frontmatter with
name+description) - No external dependencies — pure Markdown skill
- No code execution required by the skill itself
Pattern improvements are very welcome. If you find a new injection vector, a hidden Unicode trick, or a download pattern that should be blocked: open an issue on the public repo (link in maintainer profile).
CC-BY-4.0 — see LICENSE. You may use, adapt, and redistribute with attribution.
This skill was extracted from a working release pipeline for HR-AI kits (openly licensed under CC-BY-4.0; note that CC-BY-4.0 is not an OSI-approved open-source software license, so "openly licensed" is the more accurate term here). It generalized from project-specific hard-gates that the maintainer was embedding into every plan-session prompt — turning a repeated copy-paste block into a first-class, configurable skill.
Maintainer: Luis Hornburg Profile: https://www.linkedin.com/in/luis-hornburg/ Version: 1.1.0 (2026-05-16)