What problem does it solve? Fetching and analyzing external content (URLs, webhooks, API responses) exposes AI workflows to prompt injection, SSRF attacks against internal networks, and embedded malicious instructions. This Skill defines mandatory patterns to neutralize those risks before content reaches analysis subagents. ## Core Features & Use Cases - URL Validation: Rejects insecure protocols, localhost, private IP ranges (RFC 1918), cloud metadata endpoints, and oversized URLs before any fetch occurs. - Security Frame Wrapping: Wraps all fetched content in an explicit UNTRUSTED context that instructs subagents to treat content as data only and never execute embedded instructions. - Platform Transforms: Converts Twitter/X URLs to the FxTwitter API with strict hostname and tweet ID validation to block spoofing attacks. - Use Case: When a research workflow fetches an article from a user-provided link, the URL is validated, content is truncated to size limits, wrapped in the security frame, and passed to an analysis subagent that extracts patterns without following any instructions inside the content. ## Quick Start Apply the security framing standard to validate and safely analyze the content at this URL before summarizing it.
