GHSA-8mf7-vv8w-hjr2: OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example python3, node, ruby) execute inline payloads via flags like -c.

This requires explicit operator configuration to add such binaries to safeBins, so impact is limited to non-default/misconfigured deployments.