security: fix SSRF on WebChannel, broken API key, add prompt-injection guardrails - #456
Closed
chrismaddern wants to merge 2 commits into
Closed
Conversation
…n guardrails 1. SSRF protection on WebChannel.read() — was zero validation, now imports and calls _assert_safe_public_url from transcribe.py before fetching. Prevents agent from reaching cloud metadata (169.254.169.254) or internal services via Jina Reader. 2. Fix broken API key in transcribe_xiaoyuzhou.sh — was using literal 'Bearer ***' instead of $GROQ_API_KEY, making the entire xiaoyuzhou transcription feature non-functional (every call returned 401). 3. Add prompt-injection guardrails to SKILL.md — warns the agent that all fetched platform content (tweets, posts, web pages, transcripts) is UNTRUSTED DATA and must never be treated as instructions. All 196 tests pass.
Verifies the SSRF protection added in the previous commit: - Rejects cloud metadata (169.254.169.254, metadata.google.internal) - Rejects localhost, 127.0.0.1, 0.0.0.0 - Rejects private IP ranges (10.x, 172.16-31.x, 192.168.x) - Allows public URLs (with and without scheme) - Verifies urlopen is NOT called when URL is blocked (SSRF check runs first) Follows the same pattern as TestDownloadAudioSafety in test_transcribe.py. All 207 tests pass (196 existing + 11 new).
Owner
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fixes
1. SSRF protection on
WebChannel.read()(MEDIUM)File:
agent_reach/channels/web.pyWebChannel.read()had zero SSRF validation — any URL was passed directly to Jina Reader (https://r.jina.ai/{url}), which fetches the target URL. An agent instructed toread http://169.254.169.254/latest/meta-data/would fetch cloud metadata via Jina Reader, potentially leaking instance credentials.Fix: Import and call
_assert_safe_public_urlfromtranscribe.pybefore constructing the Jina Reader URL. This reuses the existing SSRF guard that rejects private IPs, localhost, and blocked hostnames.2. Fix broken API key in
transcribe_xiaoyuzhou.sh(HIGH)File:
agent_reach/scripts/transcribe_xiaoyuzhou.sh:116,140The curl invocations to Groq's Whisper API used
-H "Authorization: Bearer ***"— a literal string***instead of$GROQ_API_KEY. The variable was correctly loaded (lines 31-37) and the Python polish step (line 203) used it correctly, but the two curl calls that perform the actual transcription hardcoded***. This made the entire xiaoyuzhou transcription feature non-functional — every transcription attempt failed with HTTP 401.Fix: Replace
Bearer ***withBearer "$GROQ_API_KEY".3. Prompt-injection guardrails in SKILL.md (MEDIUM)
File:
agent_reach/skill/SKILL.mdThe skill file instructs the agent to fetch content from 15 platforms (tweets, Reddit posts, YouTube transcripts, web pages via Jina Reader) and feed it into the agent's context. There were zero guardrails instructing the agent to treat fetched content as untrusted data. A malicious tweet, Reddit post, or web page could contain text like "Ignore all previous instructions" that the agent might follow.
Fix: Added a prominent
⚠️ 安全规则section to SKILL.md warning the agent that all fetched content is UNTRUSTED DATA and must never be treated as instructions.Test Results
All 196 existing tests pass:
Security Audit Context
These fixes were identified during a comprehensive security audit of the repo. The audit found strong security hygiene overall (no
shell=True, atomic0o600credential files,shlex.quotefor shell-sourceable files,yaml.safe_loadexclusively,--end-of-options marker for yt-dlp). These 3 issues were the only must-fix items.