tmp

agent/escort/tools/system/envs.js

@@ -13,21 +13,22 @@ export const getEnvTool = tool(
   async (input) => {
     const { name } = input || {};
 
+    const sensitiveKeys = ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'CREDENTIAL'];
+    const isSensitive = (key) => sensitiveKeys.some(s => key.toUpperCase().includes(s));
+
     if (name) {
       const value = process.env[name];
       if (value === undefined) {
         return JSON.stringify({ error: `Environment variable '${name}' not found` });
       }
-      return JSON.stringify({ name, value });
+      // 按名查询同样脱敏，防止 LLM 绕过读取密钥
+      return JSON.stringify({ name, value: isSensitive(name) ? '***REDACTED***' : value });
     }
 
     // 返回所有环境变量（过滤敏感信息）
     const env = { ...process.env };
-    const sensitiveKeys = ['API_KEY', 'SECRET', 'PASSWORD', 'TOKEN', 'CREDENTIAL'];
-    
     for (const key of Object.keys(env)) {
-      const upperKey = key.toUpperCase();
-      if (sensitiveKeys.some(s => upperKey.includes(s))) {
+      if (isSensitive(key)) {
         env[key] = '***REDACTED***';
       }
     }