Secret isolation: agent can access env vars in container

We're running OpenClaw via Moltworker and noticed that the agent can access environment variables (including ANTHROPIC_API_KEY and other secrets) via shell commands like printenv.
When running locally (Docker + Clawdbot gateway), the agent is properly sandboxed—secrets stay in the gateway process, agent subprocess has a clean environment.
In the Moltworker container pattern, secrets passed via wrangler secret become container env vars, visible to the agent's shell.
Is there a recommended pattern for secret isolation in this architecture? Options we're considering:

Worker-layer credential proxy (container never sees secrets)
Output filtering/redaction
Restricted shell with scrubbed env

Curious if others have solved this or if there's a Cloudflare-native approach we're missing.