diff --git a/CHANGELOG.md b/CHANGELOG.md
index b12b4da690..d386205e08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,7 @@ Docs: https://docs.openclaw.ai
 - Browser: secure Chrome extension relay CDP sessions.
 - Docker: use container port for gateway command instead of host port. (#5110) Thanks @mise42.
 - fix(lobster): block arbitrary exec via lobsterPath/cwd injection (GHSA-4mhr-g7xj-cg8j). (#5335) Thanks @vignesh07.
-- Security: block LD_/DYLD_ env overrides for host exec. (#4896) Thanks @HassanFleyah.
+- Security: block LD*/DYLD* env overrides for host exec. (#4896) Thanks @HassanFleyah.
 - Security: harden web tool content wrapping + file parsing safeguards. (#4058) Thanks @VACInc.
 - Security: enforce Twitch `allowFrom` allowlist gating (deny non-allowlisted senders). Thanks @MegaManSec.
 
diff --git a/docs/nodes/index.md b/docs/nodes/index.md
index d471f3d829..7b5aaa1a28 100644
--- a/docs/nodes/index.md
+++ b/docs/nodes/index.md
@@ -338,4 +338,4 @@ Notes:
 ## Mac node mode
 
 - The macOS menubar app connects to the Gateway WS server as a node (so `openclaw nodes …` works against this Mac).
-- In remote mode, the app opens an SSH tunnel for the Gateway port and connects to `localhost`.
\ No newline at end of file
+- In remote mode, the app opens an SSH tunnel for the Gateway port and connects to `localhost`.
diff --git a/docs/providers/moonshot.md b/docs/providers/moonshot.md
index 3a09fb8b9e..0ae961276b 100644
--- a/docs/providers/moonshot.md
+++ b/docs/providers/moonshot.md
@@ -14,6 +14,7 @@ provider and set the default model to `moonshot/kimi-k2.5`, or use
 Kimi Coding with `kimi-coding/k2p5`.
 
 Current Kimi K2 model IDs:
+
 <!-- moonshot-kimi-k2-ids:start -->
 
 - `kimi-k2.5`
diff --git a/extensions/line/src/channel.ts b/extensions/line/src/channel.ts
index fd8f668350..5b56f42b9d 100644
--- a/extensions/line/src/channel.ts
+++ b/extensions/line/src/channel.ts
@@ -349,9 +349,7 @@ export const linePlugin: ChannelPlugin<ResolvedLineAccount> = {
       let lastResult: { messageId: string; chatId: string } | null = null;
       const quickReplies = lineData.quickReplies ?? [];
       const hasQuickReplies = quickReplies.length > 0;
-      const quickReply = hasQuickReplies
-        ? createQuickReplyItems(quickReplies)
-        : undefined;
+      const quickReply = hasQuickReplies ? createQuickReplyItems(quickReplies) : undefined;
 
       const sendMessageBatch = async (messages: Array<Record<string, unknown>>) => {
         if (messages.length === 0) {
diff --git a/src/agents/auth-profiles/oauth.ts b/src/agents/auth-profiles/oauth.ts
index b5a52dd277..8780b4705c 100644
--- a/src/agents/auth-profiles/oauth.ts
+++ b/src/agents/auth-profiles/oauth.ts
@@ -19,8 +19,10 @@ const OAUTH_PROVIDER_IDS = new Set<OAuthProvider>(
   getOAuthProviders().map((provider) => provider.id),
 );
 
-const isOAuthProvider = (provider: string): provider is OAuthProvider =>
-  OAUTH_PROVIDER_IDS.has(provider as OAuthProvider);
+function isOAuthProvider(provider: string): provider is OAuthProvider {
+  // biome-ignore lint/suspicious/noExplicitAny: type guard needs runtime check
+  return OAUTH_PROVIDER_IDS.has(provider as any);
+}
 
 const resolveOAuthProvider = (provider: string): OAuthProvider | null =>
   isOAuthProvider(provider) ? provider : null;