Summary

Sandboxed agents can extract API secrets by reading the resolved config values. When environment variables like ${NOTION_API_KEY} are substituted in the config, the resolved values (actual API keys) are exposed through the config get CLI command and API responses.

Steps to Reproduce

1. Configure an API key using env var substitution in openclaw.json:

   {
     "someService": {
       "apiKey": "${MY_API_KEY}"
     }
   }

2. From a sandboxed agent session, run:

   openclaw config get someService.apiKey
   

3. The actual API key value is returned, not the ${MY_API_KEY} placeholder

Impact

• Agents running in sandbox mode can extract any API credentials configured via env var substitution
• This defeats the purpose of sandbox isolation for secret protection
• Malicious prompts could instruct the agent to exfiltrate credentials

Suggested Fixes

1. Config redaction - Redact resolved secrets in CLI/API responses using a sentinel like __REDACTED__

2. Gateway tool pattern - For API-dependent tools, have the gateway inject credentials server-side so agents only see tool results, never the keys

Reference Implementation

We've implemented these fixes in a security-focused fork: https://github.com/JWPapi/openclaw/tree/feat/secure-gateway-tools

Key changes:

• src/cli/config-cli.ts - Redact secrets before output
• src/agents/tools/notion-tool.ts - Example gateway tool pattern
• src/agents/sandbox/constants.ts - Safe gateway tools in default allow list

Happy to discuss the approach or contribute upstream if there's interest.