fix(security): add nil checks for envSet and extraEnv

pkg/tools/shell/env.go

@@ -115,18 +115,22 @@ func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraE
 		}
 	}
 
+	if envSet != nil {
 		for k, v := range envSet {
 			vars[envKey(k)] = v
 		}
+	}
 
 	// Merge extraEnv (tool call) - highest priority
 	// Filter against LLM blocklist to prevent override of sensitive vars
+	if extraEnv != nil {
 		for k, v := range extraEnv {
 			if LLMBlocklist[envKey(k)] {
 				continue // Skip blocked vars
 			}
 			vars[envKey(k)] = v
 		}
+	}
 
 	// Convert to []string for exec.Cmd.Env
 	result := make([]string, 0, len(vars))