pub const STRIPPED_ENV: &[&str];Expand description
Environment variables an interpreter child never inherits.
Handler scripts run as the operator and are not sandboxed — AGENTS.md’s trust
boundary — but a script’s job is to answer a network event, and the one secret this
process holds for its own use is the model backend’s API key. Nothing a handler does
needs it, while a handler supplied over MCP, loaded from a .netget file or written by
the model in operator chat could print(os.environ["NETGET_API_KEY"]) into its stderr,
which is logged. The same goes for every other credential-shaped name: the names below
are removed exactly, any variable whose name contains one of SECRET_NAME_PARTS is
removed, and so is any whose name ends with one of SECRET_NAME_SUFFIXES. All three
compare case-insensitively. PATH, HOME, LANG and the rest pass through, so
interpreters still find their modules.
This is defence in depth, not a boundary. A script runs as the same user as NetGet, so it
can read ~/.aws/credentials, ~/.netrc or the parent’s environment through
/proc/<ppid>/environ where the platform exposes it; removing names from the child’s
environment only keeps a secret out of the place a careless handler would print it from.