Summary

The exec preflight source-file scanner (security=full) flags $IDENTIFIER patterns inside Python string literals (docstrings, f-strings, argparse help text) as shell variable injection. This blocks execution of any Python skill that prints dollar-formatted output or uses $ as a currency label.

A simple, direct command triggers the block:

python3 ./skills/polymarket-copytrading/copytrading_trader.py --reactor --once

Version

OpenClaw 2026.4.14 (323493f)

Error

exec preflight: detected likely shell variable injection ($SIM) in python script:
copytrading_trader.py:267.
In Python, use os.environ.get("SIM") instead of raw $SIM.
(If this is inside a string literal on purpose, escape it or restructure the code.)

Exec policy

security=full
ask=off

The issue only occurs with security=full. This is distinct from the "complex interpreter invocation" issues (#62467, #67270, #66128) — those are about command patterns. This is about the file content scanner.

Root cause

The preflight regex matches $[A-Z_]+ in .py files without checking whether the match is inside a string literal. All occurrences in this file are inside Python strings:

None are shell variable references. None are inside os.system(), subprocess, or any execution context. The f-string pattern f"${var:.2f}" is standard Python for printing dollar-prefixed numbers.

Impact

• Blocks any financial/trading skill that prints dollar amounts (e.g. f"${cost:.2f}") or uses $ as a currency label
• The scanner's own suggestion ("use os.environ.get("SIM") instead") is incorrect — $SIM here is a currency label, not an environment variable
• No user-configurable workaround exists — security=full is the only mode between deny and allowlist that allows general exec, and there's no way to disable just the source-file scan
• Affects published ClawHub skills that users can't easily modify

Suggested fix

The scanner should do one of:

1. Execution-context check — only flag $IDENTIFIER patterns inside os.system(), subprocess.*, or similar execution calls. This matches the actual threat model (shell injection) and is the simplest correct fix.
2. AST-aware check — parse the Python file and only flag $IDENTIFIER outside string literals. More thorough but f-string AST parsing has edge cases.
3. Heuristic improvement — skip $ matches that are followed by { (f-string format spec, e.g. ${var:.2f}) or are inside triple-quoted strings.

Reproduction

Any .py file with $SIM or f"${variable:.2f}" inside a string literal will trigger the block when run via exec with security=full.

# test.py — this file is blocked by preflight
def main():
    cost = 42.50
    print(f"Total: ${cost:.2f}")  # standard dollar formatting

if __name__ == "__main__":
    main()

$ /exec security=full
$ python3 test.py
# → exec preflight: detected likely shell variable injection ($cost)