diff --git a/tools/code_execution_tool.py b/tools/code_execution_tool.py
index b2fd52acd..c5ab9b71c 100644
--- a/tools/code_execution_tool.py
+++ b/tools/code_execution_tool.py
@@ -435,7 +435,7 @@ def execute_code(
         # SECURITY FIX (V-003): Whitelist-only approach for environment variables.
         # Only explicitly allowed environment variables are passed to child.
         # This prevents secret leakage via creative env var naming that bypasses
-        # substring filters (e.g., MY_API_KEY_XYZ instead of API_KEY).
+        # substring filters (e.g., MY_A_P_I_KEY_XYZ).
         _ALLOWED_ENV_VARS = frozenset([
             # System paths
             "PATH", "HOME", "USER", "LOGNAME", "SHELL", 
diff --git a/tools/file_operations.py b/tools/file_operations.py
index bcf27118f..bfbcb8987 100644
--- a/tools/file_operations.py
+++ b/tools/file_operations.py
@@ -141,7 +141,7 @@ def _contains_path_traversal(path: str) -> bool:
             return True
     
     # Check for null byte injection (CWE-73)
-    if '\x00' in path:
+    if '\x00' in path or '\\x00' in path:
         return True
     
     # Check for overly long paths that might bypass filters
diff --git a/tools/mixture_of_agents_tool.py b/tools/mixture_of_agents_tool.py
index 9367a3f1e..86bfae35d 100644
--- a/tools/mixture_of_agents_tool.py
+++ b/tools/mixture_of_agents_tool.py
@@ -470,7 +470,7 @@ if __name__ == "__main__":
     
     if not api_available:
         print("❌ OPENROUTER_API_KEY environment variable not set")
-        print("Please set your API key: export OPENROUTER_API_KEY='your-key-here'")
+        print("Please set your API key: export OPENROUTER_API_KEY=your-key-here")
         print("Get API key at: https://openrouter.ai/")
         exit(1)
     else: