A background service that scans every directory OpenClaw opens for malicious .env files, poisoned configs, and environment variable injection payloads before the agent loads them

CVE-2026-41294 (CVSS 8.6) proved that a single .env file in the wrong directory can override OpenClaw security settings during startup. The attack surface is broad: any git clone, any downloaded project, any shared workspace could contain a weaponized .env. OpenClaw loads env vars from the current working directory before establishing its trusted configuration. This tool runs as a pre-flight scan before OpenClaw starts, checking every .env file in the workspace chain for suspicious overrides, known injection patterns, and variables that should never come from untrusted sources.