Live round-trip test showed openclaw's SSRF guard blocking the localhost guild file URL passed via MediaUrls. We already download the bytes with the agent's guild token, so MediaUrls is redundant and noisy — provide only local MediaPaths/MediaTypes. Verified: plugin logs 'fetched N attachment(s)' and the SSRF WARN is gone. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>