diff --git a/packages/cli/src/telemetry/agent_runtime.test.ts b/packages/cli/src/telemetry/agent_runtime.test.ts
index 5fd2f71f8f..6ee9ed9cda 100644
--- a/packages/cli/src/telemetry/agent_runtime.test.ts
+++ b/packages/cli/src/telemetry/agent_runtime.test.ts
@@ -22,7 +22,6 @@ const VENDOR_ENV_KEYS = [
   "REPL_ID",
   "REPLIT_USER",
   "HERMES_QUIET",
-  "OPENCLAW_STATE_DIR",
   "OPENCLAW_CONFIG_PATH",
   "PI_CODING_AGENT",
   "CLINE_ACTIVE",
@@ -220,8 +219,8 @@ describe("detectAgentRuntime — Replit / Hermes / openclaw / Pi", () => {
     expect(detectAgentRuntime()).toBe("hermes");
   });
 
-  it("detects openclaw via inherited OPENCLAW_STATE_DIR", async () => {
-    process.env["OPENCLAW_STATE_DIR"] = "/tmp/openclaw";
+  it("detects openclaw via inherited OPENCLAW_CONFIG_PATH", async () => {
+    process.env["OPENCLAW_CONFIG_PATH"] = "/tmp/openclaw/openclaw.json";
     const { detectAgentRuntime } = await import("./agent_runtime.js");
     expect(detectAgentRuntime()).toBe("openclaw");
   });
diff --git a/packages/cli/src/telemetry/agent_runtime.ts b/packages/cli/src/telemetry/agent_runtime.ts
index 9f8ac5f706..ddb1858877 100644
--- a/packages/cli/src/telemetry/agent_runtime.ts
+++ b/packages/cli/src/telemetry/agent_runtime.ts
@@ -134,17 +134,13 @@ const VENDOR_RULES: VendorRule[] = [
     name: "hermes",
     check: (env) => typeof env["HERMES_QUIET"] === "string",
   },
-  // openclaw — multi-channel AI gateway. When openclaw spawns a CLI
-  // subprocess it builds the child env with OPENCLAW_STATE_DIR /
-  // OPENCLAW_CONFIG_PATH / OPENCLAW_DISABLE_AUTO_UPDATE set explicitly
-  // (extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts:344-351).
-  // We key on OPENCLAW_STATE_DIR since it's a path scope-bound to openclaw.
+  // openclaw — multi-channel AI gateway. It sets OPENCLAW_CONFIG_PATH on the
+  // CLI subprocesses it spawns. Never name its state-dir var here: endpoint
+  // scanners flag that string as an IoC and quarantine the bundle (#5245).
   // Source: https://github.com/openclaw/openclaw
   {
     name: "openclaw",
-    check: (env) =>
-      typeof env["OPENCLAW_STATE_DIR"] === "string" ||
-      typeof env["OPENCLAW_CONFIG_PATH"] === "string",
+    check: (env) => typeof env["OPENCLAW_CONFIG_PATH"] === "string",
   },
   // Pi coding agent (https://pi.dev, https://github.com/earendil-works/pi).
   // packages/coding-agent/src/cli.ts:13 unconditionally executes