Web Fetch Fallback

Fetch web content using curl as a fallback when web_fetch is blocked due to private, internal, or special-use IP address restrictions.

This skill is coherent with its purpose but is explicitly designed to bypass platform IP restrictions — that is risky. Before installing or using it: 1) Ensure curl is available on the agent host (the metadata should declare curl as a required binary). 2) Restrict use to trusted, internal URLs and avoid passing untrusted user input directly into the fetch command to reduce SSRF/exfiltration risk. 3) Prefer running it only when explicitly invoked by a user (not autonomously), and consider adding domain whitelisting or additional URL validation. 4) Be cautious about sending Authorization headers or other secrets via this fallback; treat such uses as sensitive and audit their usage.

Type: OpenClaw Skill Name: web-fetch-fallback Version: 1.0.0 The 'web-fetch-fallback' skill is explicitly designed to bypass OpenClaw's built-in SSRF (Server-Side Request Forgery) protections. The instructions in SKILL.md direct the AI agent to use curl via the exec tool specifically when the standard web_fetch tool blocks access to private, internal, or special-use IP addresses. While the documentation includes caveats about using it only for trusted internal services, providing a functional mechanism to circumvent security controls and access internal network resources is a high-risk capability that could be exploited for unauthorized internal discovery or data exfiltration.