fix(skills-hub): cover remaining SSRF fetch paths (salvage #22804)

[teknium1]

Summary

Salvage of #22804 — tools/skills_hub.py now does manual redirect re-validation across all attacker-controlled fetch paths (UrlSource, WellKnownSkillSource, ClawHubSource rawUrl fallback), closing the redirect-bypass gap that #10029's preflight is_safe_url doesn't cover.

Threat model

Three fetch paths take URLs the attacker controls:

• UrlSource._fetch_text() — user runs hermes skills install <attacker-URL>
• WellKnownSkillSource._parse_index() / _fetch_text() — attacker-controlled .well-known/skills/ server lists arbitrary URLs
• ClawHubSource._fetch_text() — rawUrl / downloadUrl from version metadata fallback path

#10029 (still open) preflights is_safe_url(url) but keeps follow_redirects=True. A public-looking URL that 302s to 127.0.0.1:6379 or 169.254.169.254/... (cloud metadata) bypasses the preflight entirely. That's the gap this PR closes for the skills hub.

Changes (contributor commit)

• tools/skills_hub.py: new _guarded_http_get helper. Disables auto-redirects, re-runs is_safe_url + check_website_access per hop (5-hop cap), uses urljoin for relative Location headers. Wires it into the four attacker-controlled fetch sites listed above.
• 3 regression tests covering direct private URL, redirect-to-private bypass, and ClawHub rawUrl private path.

Other fetch sites in the file (clawhub.ai download, skills.sh, api.github.com, lobehub, hermes docs) target hard-coded trusted hosts and aren't SSRF surface.

Validation

• 236 skills_hub / SSRF / url_safe tests pass on the salvage branch.
• This PR is a strict superset of the still-open fix(security): add SSRF checks to Skills Hub fetches #10029 — same preflight + adds redirect re-validation. Recommend closing fix(security): add SSRF checks to Skills Hub fetches #10029 in favor of this once merged.

Closes #13583 (covers the remaining SSRF fetch paths). Supersedes #10029.

[github-actions]

🔎 Lint report: salvage/pr-22804 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 7953 on HEAD, 7953 on base (➖ 0)

🆕 New issues (3):

Rule	Count
invalid-argument-type	3

First entries

run_agent.py:12944: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:6872: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`
run_agent.py:12941: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`

✅ Fixed issues (3):

Rule	Count
invalid-argument-type	3

First entries

run_agent.py:12944: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown, Unknown] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:12941: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`
run_agent.py:6872: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`

Unchanged: 4198 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.