C-string manipulation
All seems good.

As you mentioned it is sensitive to trailing slash being missing. I would just force that issue and always append one between the prefix and the path. An extra slash will not hurt but a missing one will.

Apart from not using C in the first place :-) all my other issues are simple stylistic ones that only 30% of people would agree (I always divide stylistic camps as 30% Side A, 30% side ~A, 40% don't care).

A tiny bit more white space to make it easier to read. But let me just say your code is not bad in that regards (just slightly less than I would use).

I don't want to recommend any particular style. But I can show you how I would have written it:

// Keep you includes sorted in alphabetical order
// Here it is not such a big deal but with big projects the list can get big
// and alphabetical order helps you find things in large lists.
#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;

#define APP_PREFIX_ENV_VAR "APP_PREFIX"

const char * app_path_prefix()
{
    char * env_prefix = getenv(APP_PREFIX_ENV_VAR);
    return (env_prefix == NULL)
               ? ""
               : env_prefix;
}

char * app_path(char * in_path)
{
    /*
     * Some people really hate this.
     *
     * Others like myself really like lining up the '=' sign
     * Just do it locally with a set of calculations. I find it easier to see
     * both the lhs and the rhs of expression quickly.
     */
    char const* prefix     = app_path_prefix();
    size_t      prefix_len = strlen(prefix);
    size_t      out_size   = prefix_len + strlen(in_path) + 1;

    /* 
     * Dynamically allocated. Released to outside world it is the
     * responsibility of the caller to free this memory
     */
    char *      out        = malloc(out_size);

    strlcpy(out, prefix, prefix_len + 1);
    strlcat(out, in_path, out_size);
    return out;
}

int main(int argc, char ** argv)
{
    /* test */
    char * path = app_path(argv[1]);
    printf("result: '%s'\n", path);
    free(path);

    return EXIT_SUCCESS;
}