Executive brief
openclaw-claude-bridge is a library that bridges Claude Code CLI to OpenClaw gateways, claiming to provide sandboxed access to code execution tools. The tool's security configuration is ineffective: setting the `--allowed-tools ""` flag does not actually restrict available tools as documented, leaving read, write, bash, and web-fetch capabilities accessible. Operators deploying this bridge publicly or in automated pipelines may believe they have disabled dangerous tools when they have not, creating a false sense of security that could enable prompt-injection attacks to execute arbitrary code.
Technical details
The vulnerability is a misconfiguration and documentation error (CWE-1188, CWE-276). In v1.1.0, the code spawns Claude Code CLI with `--allowed-tools ""`, claiming this disables all tools per the README. However, `--allowed-tools` (or `--allowedTools`) is documented as an auto-approve allowlist for tools that execute without prompts, not a restriction on tool availability. The correct flag to restrict tools is `--tools`. As a result, all CLI tools (Read, Write, Bash, WebFetch) remain nominally available; actual execution in non-interactive `--print` mode depends on undocumented CLI behavior that may auto-deny, error, or hang. If Claude Code CLI behavior changes in future versions to auto-allow tools in print mode, prompt-injection attacks could trigger arbitrary code execution in the gateway's process context. The vulnerability was fixed in v1.1.1 by switching to `--tools ""` and renaming the environment variable from `CLAUDE_ALLOWED_TOOLS` to `CLAUDE_TOOLS`.
Affected products
- SeaL773 openclaw-claude-bridge < 1.1.1
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in v1.1.1