OpenClaw Tools, Part 3: Turning Off the File Tools Does Not Make exec Read-Only
exec is a mutating shell surface: disabling write, edit, and apply_patch does nothing to make it read-only. And since sandboxing is off by default, host=auto actually resolves to the gateway — if you really want the sandbox, say so explicitly and it will at least fail closed.