Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/ssrf-internal-network/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/ssrf-internal-network)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ssrf-internal-network"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ssrf-internal-network/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ssrf-internal-network"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ssrf-internal-network.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.01180 |
| Opus 5.5 | $0.00036 | $0.00472 |
| Sonnet 5.5 | $0.00018 | $0.00236 |
| Haiku 4.5 | $0.00009 | $0.00118 |
Grade C, and why
ssrf-internal-network scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
AWS: http://169.254.169.254/latest/meta-data/ What it actually says
ssrf-internal-network — SSRF 与内网横向专项深度挖掘
何时调用（触发条件）
- 请求中存在 URL 参数（url、link、img、redirect、callback、webhook、notify_url）
- 服务端抓取/代理/转发功能（爬虫、采集、预览、转码）
- 回调类功能（支付回调、Webhook 配置、回调验证）
- 二维码/短链生成、在线解压（远程 URL）
- 图片/文档/音视频在线预览
一、SSRF 场景清单
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| 二维码生成 | SSRF/XSS/钓鱼 | URL参数可控、二维码内容可控 |
| 短链服务 | 重定向/SSRF/遍历 | 短链可预测、目标URL可控 |
| 代理/转发服务 | SSRF/内网穿透 | 目标地址可控、协议可控 |
| 爬虫/采集功能 | SSRF/RCE | 采集URL可控、解析引擎漏洞 |
| 在线预览(文档/代码) | SSRF/XSS/RCE | 远程URL加载、渲染引擎漏洞 |
| 模板/报表生成 | SSTI/任意文件读取 | 用户输入进入模板引擎 |
| Webhook/回调配置 | SSRF/信息泄露 | 回调URL可控、内网探测 |
| 文件预览（PDF/Office） | SSRF/XXE/RCE | 远程URL加载、OLE对象 |
| 图片处理 | SSRF | url:协议（ImageMagick） |
| 视频/音频处理 | SSRF/文件读取 | concat协议、HLS playlist（FFmpeg） |
二、云元数据（打内网核心）
AWS: http://169.254.169.254/latest/meta-data/
阿里云: http://100.100.100.200/latest/meta-data/
腾讯云: http://metadata.tencentyun.com/latest/meta-data/
目标：获取临时凭证（IAM Role）、实例元数据、网络配置，进一步接管云资产。
三、内网探测思路
- 先验证可控性：请求外网可控地址（Burp Collaborator / DNSLog / 自己的 VPS）确认请求发出
- 内网网段探测：扫描 127.0.0.1、10.x、172.16-31.x、192.168.x 常见端口
- Redis 未授权：
gopher://写入 crontab/SSH key/主从复制 RCE - 管理面板：内网 Jenkins/ES/Grafana/MySQL 等
- 协议利用：
file:///etc/passwd gopher://127.0.0.1:6379/_<redis命令> dict://127.0.0.1:6379/info - DNS 重绑定：注册域名解析到 127.0.0.1/内网 IP，绕过 IP 校验
- 重定向绕过：302 跳转至内网/云元数据，绕过 URL 白名单
四、绕过技术
- IP 混淆：十进制/十六进制/八进制（
2130706433、0x7f000001、0177.0.0.1） - 短域名/URL 解析差异（
http://[email protected]） - 重定向（
http://evil.com/redirect?to=169.254.169.254） - DNS 重绑定
- 编码（双重 URL 编码、Unicode）
- 协议差异（代理与后端解析不一致）
五、验证要点
- 先证明出网（DNSLog 外带），再证明内网可达
- 云元数据：能读取即为严重（临时凭证可能接管云账号）
- 内网 Redis/数据库：未授权可交互即为严重
- 响应差异：端口开放/关闭、服务指纹、错误信息
- 报告标注：网络位置、出网方向、可达内网网段
六、修复建议
- URL 白名单（协议+域名+端口），禁止私网地址
- 禁用重定向跟随、禁用危险协议（file/gopher/dict）
- DNS 解析后二次校验 IP，防 DNS 重绑定
- 出口流量隔离、最小权限网络策略
- 云元数据服务：IMDSv2 + 限制访问
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 81 lines · 89 tokens per session scan C 4c9cc8a70733
ssrf-internal-network is a skill published in the GitHub repository zhaji2333/CkSKILLS (126 stars, last pushed 1mo ago), licensed MIT. It adds 89 tokens to every session and 1,180 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
yida-data-management
A tool for querying, adding, and updating Yida form records, child tables, process records, and task-center data. It keeps ordinary forms and approval workflows on their separate data interfaces.
yida-aggregate-table
A workflow for managing Yida aggregate tables, also called virtual views. These are tables built from related form data rather than ordinary standalone records.
yida-db-seq-fix
A tool for checking and correcting PostgreSQL sequences, which generate automatic numeric IDs for new rows. It is designed for Yida databases after automatic table creation or data migration.
mongodb-qe-size-estimation
Estimates the storage and memory impact of encrypting fields in collections with Queryable Encryption (QE) enabled. Do NOT use for collections that use Client-Side Field Level Encryption (CSFLE) instead of QE.
doris-repo-review
Review an Apache Doris PR from a local clone with the same multi-agent, shared-ledger convergence workflow as the CI Code Review Runner. Use when the user supplies a PR to /doris-repo-review, asks to review a Doris PR locally, or asks for the CI-style review flow. Safely align only the current worktree to the exact PR…
doris-best-practices
Apache Doris table design and cluster sizing best practices. MUST USE when writing, reviewing, or optimizing Doris CREATE TABLE statements, partition/bucket strategies, data models, or cluster configurations. ALSO MUST USE whenever the doris-architecture-advisor skill produces DDL — apply the Pre-Flight Checklist to…