Since you already mention milter in your question: a milter would be capable to modify the message bodies and can solve your problem.
The xxfi_body callback of libmilter allows you to obtain the message body.
When the xxfi_eom callback is called, you can use smfi_replacebody to replace the body of the message.
This would allow you to search for URLs in the bodies and append a warning message to them.
Notes:
- You need to add the
SMFIF_CHGBODY flag to the value of xxfi_flags when calling smfi_register, otherwise calling smfi_replacebody will fail
- Changing the message body may have a significant performance impact
- When configuring your MTA, the order of filters matters: later filters get the new body contents, when a previous filter replaces the body
- As noted in the comments: when you modify the message contents, things like PGP, S-MIME, etc. might break
- You might need to interpret the
Content-Type of the message (and it's mime parts) so that you can distinguish between text/plain and text/html messages and append the warning message at the proper position
For more information on how to write a milter application, you can find the current HTML docs in the sendmail source under the path libmilter/docs/index.html.
There is also an online version (may not be the latest one).