[Security]: security audit does not flag missing web_fetch URL allowlist #19
Description
Bug type
Missing check
Summary
openclaw security audit does not check whether a URL allowlist is
configured for the web_fetch tool. Without one, an attacker who achieves
prompt injection can exfiltrate data to any external URL (T-EXFIL-001).
The SSRF guard blocks internal networks but permits all external URLs.
Expected behavior
[warn] tools.web_fetch.no_url_allowlist — web_fetch has no outbound URL restrictions
Actual behavior
No finding is emitted.
OpenClaw version
Latest
Operating system
All