openclaw - 💡(How to fix) Fix secrets audit: false positive PLAINTEXT_FOUND for environment variable references in models.json

Bug Description

openclaw secrets audit --check reports PLAINTEXT_FOUND for apiKey fields in models.json, but these are actually environment variable references, not plaintext secrets.

Steps to Reproduce

1. Configure apiKey in models.json using environment variable reference (e.g., "apiKey": "OPENCLAW_DEEPSEEK_API_KEY")
2. Run openclaw secrets audit --check
3. Observe false positive PLAINTEXT_FOUND warnings

Expected vs Actual

• Expected: No warning when apiKey values are environment variable names (not actual secrets)
• Actual: Warns about apiKey being "stored as plaintext" even though values are env var names like OPENCLAW_DEEPSEEK_API_KEY

Environment

• OpenClaw version: 2026.5.27
• OS: Ubuntu 25.10

Additional Context

The apiKey field in models.json correctly uses environment variable references:

"deepseek": {
  "apiKey": "OPENCLAW_DEEPSEEK_API_KEY"
}

The actual secrets are stored in environment variables, not in the config file. The audit tool should distinguish between actual plaintext secrets and environment variable name references.