openclaw - 💡(How to fix) Fix Env vars from .env not passed to sandbox exec calls — generic provider placeholder not resolved [1 comments, 2 participants]

Description

Environment variables defined in ~/.openclaw/.env are not available inside sandbox exec calls. When a generic OpenShell provider is configured (e.g., ncbi with credential key NCBI_API_KEY), the env var inside the sandbox resolves to the OpenShell placeholder openshell:resolve:env:NCBI_API_KEY rather than the actual value.

It's unclear whether OpenClaw is responsible for passing the resolved env var value to OpenShell when creating the sandbox, or whether OpenShell's L7 proxy should resolve the placeholder. Filing here for the OpenClaw side of the issue.

Setup

openclaw.json (relevant sections):

{
  "env": {
    "shellEnv": {
      "enabled": true,
      "timeoutMs": 15000
    }
  },
  "plugins": {
    "entries": {
      "openshell": {
        "enabled": true,
        "config": {
          "from": "openshell/sandbox-from:1774813410",
          "providers": ["ncbi"]
        }
      }
    }
  }
}

~/.openclaw/.env:

NCBI_API_KEY=<redacted>

OpenShell provider:

openshell provider create --name ncbi --type generic --credential NCBI_API_KEY

Gateway: running via systemd (user service), which has Environment=NCBI_API_KEY=<value> set.

Steps to reproduce

1. Configure as above

2. In a sandbox exec call, reference $NCBI_API_KEY in a curl URL:

   exec curl -s "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi?db=pubmed&api_key=$NCBI_API_KEY&term=test"

3. The L7 proxy log shows the URL contains api_key=openshell:resolve:env:NCBI_API_KEY instead of the actual key.

Expected behavior

$NCBI_API_KEY should resolve to the real value inside sandbox exec calls — either:

• OpenClaw passes the resolved value to OpenShell when creating the sandbox, or
• OpenClaw instructs OpenShell to resolve the placeholder before the request leaves the proxy

Actual behavior

The placeholder openshell:resolve:env:NCBI_API_KEY is passed through unresolved.

Environment

• OpenClaw: v2026.3.28 (gateway mode, systemd)
• OpenShell: 0.0.16
• Also filed as NVIDIA/OpenShell#668

Workaround

Hardcode the API key directly in skill files / curl URLs.