openclaw - 💡(How to fix) Fix secrets audit: Improve detection to distinguish plaintext secrets from environment variable references

Problem

When running openclaw secrets audit --check, the tool reports PLAINTEXT_FOUND for apiKey fields that contain environment variable references like OPENCLAW_DEEPSEEK_API_KEY. These are NOT actual secrets — they are just variable names pointing to secrets stored in environment variables.

User Impact

This causes confusion and frustration for users with high standards for security hygiene. Even when users correctly store secrets in environment variables (not in config files), they still see 4 false positive warnings every time they run the audit.

Expected Behavior

The audit tool should distinguish between:

1. Actual plaintext secrets: Real API keys stored directly in config files → should warn
2. Environment variable references: Variable names like OPENCLAW_DEEPSEEK_API_KEY → should NOT warn

Suggested Fix

Add logic to detect if apiKey values look like environment variable references:

• Check for patterns like *_KEY, *_TOKEN, *_SECRET, *_PASSWORD
• If the value matches these patterns, skip the PLAINTEXT_FOUND warning
• Only warn when actual secret values (not just variable names) are detected

Additional Context

• This is not a security vulnerability — it is a UX issue
• The current behavior makes users question their correct configuration
• Users who store secrets properly (via environment variables) should not see warnings