You can use REXX to create environment variables that the CMD.EXE either can not read or not write.
To create read-only environment variables use names with an imbedded equal sign, for example =MYREXXVAR.
The CMD.EXE can only read (but not change) environment variables that contain equal signs in the name. It is not possible to modify or delete those variables from the command line or from within a plain batch program.
---------- * ----------
To create write-only environment variables use the names 0, 1, to 9.
The CMD.EXE can only write (or delete) these environment variables but not read them. If you code something like
ECHO %1 SET myvar=%2
%1 or %2 always reference the parameter of the batch program. And if you use them on the command line they are either empty or contain their name as value.