[Security]: security audit does not check if dangerous environment variables are set #18
Description
Bug type
Missing check
Summary
The host-env-security-policy.json blocklist prevents the exec tool from
passing dangerous env vars, but openclaw security audit never checks
if any of these variables are actually set in the current environment.
If GLIBC_TUNABLES, NODE_OPTIONS, etc. are unexpectedly present, it could
indicate a compromised or misconfigured host. The audit should flag this.
Expected behavior
[warn] env.dangerous_vars_set — 2 dangerous environment variables are set
Actual behavior
No finding is emitted.
OpenClaw version
Latest
Operating system
All (especially Linux)