ssrf-prevention
Installation
SKILL.md
SSRF Prevention
Prevent attackers from using your server as a proxy into internal networks, cloud metadata endpoints, databases, admin panels, and private services. SSRF is OWASP A10 and is commonly introduced by vibe-coded features such as URL previews, webhook testers, image importers, PDF generators, and "fetch this URL" integrations.
The Rule
NEVER fetch a user-provided URL directly. ALWAYS validate destination, resolve DNS safely, block private networks, and enforce egress allowlists.
What SSRF Can Expose
| Target | Why it matters |
|---|---|
169.254.169.254 |
AWS/GCP/Azure instance metadata credentials |
127.0.0.1 / localhost |
Local admin dashboards, debug servers, Redis, Docker APIs |
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
Internal networks and private services |
| IPv6 loopback/link-local | ::1, fe80::/10, IPv4-mapped bypasses |
| Internal DNS names | db.internal, admin.local, Kubernetes service names |
| Redirect chains | Valid public URL redirects to internal endpoint |