We've been working on exactly this problem from the credential layer side. The root issue isn't that frameworks lack auth features — it's that .env files are the path of least resistance, and every framework optimizes for that path. Not just a problem for OpenClaw but also for the more 'trusted' regular CLI agents.

One thing the report doesn't cover: even with perfect credential injection, agents can still leak secrets through their output. An agent that received a key via a proxy can print it into a chat window, a log, or a commit message.

Great research. The 93% unscoped key finding matches what we see in practice. We built nornr.com specifically for the spend side of this: agents request a mandate before any financial action, policy scopes what's allowed (amount, vendor, frequency), every decision gets a signed receipt for audit. Works with existing payment rails. The delegation and revocation gaps you identified are first class concerns in our model. Would be interesting to see how your framework scores projects that adopt a mandate based approach.