openclaw/src/infra/host-env-security-policy.json

{
  "blockedKeys": [
    "NODE_OPTIONS",
    "NODE_PATH",
    "PYTHONHOME",
    "PYTHONPATH",
    "PERL5LIB",
    "PERL5OPT",
    "RUBYLIB",
    "RUBYOPT",
    "BASH_ENV",
    "ENV",
    "GIT_EXTERNAL_DIFF",
    "SHELL",
    "SHELLOPTS",
    "PS4",
    "GCONV_PATH",
    "IFS",
    "SSLKEYLOGFILE"
  ],
  "blockedOverrideKeys": ["HOME", "ZDOTDIR"],
  "blockedPrefixes": ["DYLD_", "LD_", "BASH_FUNC_"]
}
refactor(security): centralize host env policy and harden env ingestion 2026-02-21 13:04:34 +01:00			`{`
			`"blockedKeys": [`
			`"NODE_OPTIONS",`
			`"NODE_PATH",`
			`"PYTHONHOME",`
			`"PYTHONPATH",`
			`"PERL5LIB",`
			`"PERL5OPT",`
			`"RUBYLIB",`
			`"RUBYOPT",`
			`"BASH_ENV",`
			`"ENV",`
fix(security): bind node system.run approvals to env 2026-02-26 16:37:54 +01:00			`"GIT_EXTERNAL_DIFF",`
fix(security): harden shell env fallback 2026-02-21 20:01:00 +01:00			`"SHELL",`
fix(security): block shell env allowlist bypass in system.run 2026-02-22 12:46:55 +01:00			`"SHELLOPTS",`
			`"PS4",`
refactor(security): centralize host env policy and harden env ingestion 2026-02-21 13:04:34 +01:00			`"GCONV_PATH",`
			`"IFS",`
			`"SSLKEYLOGFILE"`
			`],`
fix(security): block HOME and ZDOTDIR env override injection 2026-02-22 09:41:55 +01:00			`"blockedOverrideKeys": ["HOME", "ZDOTDIR"],`
refactor(security): centralize host env policy and harden env ingestion 2026-02-21 13:04:34 +01:00			`"blockedPrefixes": ["DYLD_", "LD_", "BASH_FUNC_"]`
			`}`