Skip to content

hasScriptEnvLeakRisk

hasScriptEnvLeakRisk(normalizedCommand): boolean

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/shell/rater.ts:518

Detect whether the command invokes an interpreter on a script target AND passes an $ALL_CAPS shell-variable expansion in its arguments — openclaw’s “script preflight”. Such a command can leak environment (often secrets) into the script, so it should bias toward escalation. Lightweight heuristic over the normalized command; a positive flag is fed to the rater prompt AND forces the fail-closed destructive path in the decision mapping.

string

boolean

true when an interpreter+script invocation also expands an ALL_CAPS env var.