add-cursor

The container-side codex provider writes the codex runtime config.toml (and, on contract cores, hooks.json) into the per-group CODEX_HOME at query time, and the hooks.json contents that would govern the codex agent runtime are not shown.

self.runtime.writeCodexConfigToml(self.mcpServers, memorySessionHook, self.inference);

The setup auth flow saves the live OAuth auth.json written by an isolated `codex login` into the configured credential gateway store via store.save, and the store's eventual storage destination (local vault file, OS keychain, or remote gateway endpoint) is not shown in the artifact.

await store.save('codex', { kind: 'oauth', file: authJsonPath });

The login helper mints a live Cursor user API key via Cursor.auth.login and writes it in plaintext to a caller-supplied host file that setup later reads into the credential gateway, placing the credential on disk during the handoff window.

fs.writeFileSync(outputPath, result.apiKey, {

The gateway probe child process prints the value of the CURSOR_API_KEY environment variable to stdout in its JSON summary, so any real credential present in that environment lands in the test log.

env: { CURSOR_API_KEY: process.env.CURSOR_API_KEY, HTTPS_PROXY: process.env.HTTPS_PROXY },

The installed Cursor provider writes NanoClaw memory-hook commands into the agent's project- and home-level .cursor/hooks.json so its payload script cursor-hook.ts executes at every session start and compaction, a persistent agent-control-plane hook whose runtime script is not shown in these units.

bun /app/src/providers/cursor-hook.ts

The gateway-proxy test collects the host process environment, filtering only proxy/CA/cursor entries, and injects it into a locally spawned probe child, so any other secrets present in the test host's environment are handed to that spawned payload script.

Object.entries(process.env)

The provider persists auto-executing hooks by writing Cursor hooks.json files into the agent project directory and the user HOME layer that run its own script `bun /app/src/providers/cursor-hook.ts` at every sessionStart and preCompact inside the container.

mergeMemoryHooks(path.join(userDir, 'hooks.json'), memory);

When the host lacks the pinned Bun, setup falls back to fetching the bun runtime from the npm registry via pnpm dlx and executing the login helper with it, a version-pinned but runtime-fetched code execution path.

return { command: 'pnpm', prefix: [`--package=bun@${pinnedBunVersion(root)}`, 'dlx', 'bun'] };

SKILL.md instructs the agent to run the setup entry 'setup/index.ts --step provider-auth cursor', a single command that copies payload files, edits barrels, pins the SDK, rebuilds, and performs Cursor credential authentication, whose setup-step implementation is not shown in the reviewed units.

pnpm exec tsx setup/index.ts --step provider-auth cursor

The add-discord, add-imessage, and add-slack skills instruct the agent to execute bash setup/lib/restart.sh, a script whose content is not included in the reviewed artifact units.

bash setup/lib/restart.sh

The add-imessage skill instructs the agent to run setup/channels/imessage-configure.sh, an unshown script that rewrites the .env backend selector for the local or hosted backend.

bash setup/channels/imessage-configure.sh local

The add-imessage skill instructs the agent to run the unshown scripts/photon-setup.ts, which the docs say provisions via Photon's cloud API and writes PHOTON_PROJECT_ID/PHOTON_PROJECT_SECRET to .env and a bearer token to data/photon-auth.json.

pnpm exec tsx scripts/photon-setup.ts setup --phone {{owner_handle}} --embedded

The add-teams skill suggests rewriting npm's global prefix via a package-manager host-config write (npm config set prefix ~/.npm-global) when the global install hits EACCES.

npm config set prefix ~/.npm-global

The add-teams skill tells the agent that Microsoft 365 login tokens may persist in the CLI's plaintext on-disk token cache and that the unencrypted-storage warning is safe to ignore.

a plaintext cache file that persists fine

writeMemorySessionHook rewrites the agent's Claude settings.json to insert a SessionStart hook entry carrying a provider-supplied command, persisting an auto-executing control-plane hook configuration that runs at every session start.

fs.writeFileSync(filePath, JSON.stringify(settings, null, 2)

Undeclared by the add-cursor skill's stated purpose, the runner enumerates the sensitive ~/.claude/projects transcript directory to select the newest .jsonl trace and rescans the same tree during continuation rotation, with comments tying the read to a /upload-trace diagnostic whose destination is not shown here.

fs.readdirSync(projects)

container/install-cli-tools.sh writes /root/.npmrc inside the container image build to opt the two pinned CLIs into pnpm build scripts — residue R61 and contradiction leads C497/C498 are confirmed only as this container-internal, comment-disclosed configuration write (not a host .npmrc persistence, not a sensitive read), and C945/C946's node -e calls only parse the local manifest, so the D15/D22/D64/D71 and D90 contradiction leads are not confirmed.

require(

docs/upgrade-recovery.md instructs coding agents to automatically run the upgrade-state override stamp and restart without asking the human whenever they judge a supported upgrade succeeded, skipping human confirmation for an integrity-tripwire override whose truth depends on the agent's own assessment.

run the command above automatically and restart. Only stop to ask a human if the upgrade itself failed or you can't confirm it finished.

The skill apply engine binds a run command's stdout — which the code notes can come from a remote server — into {{vars}} and interpolates those vars into later shell command lines, so remote-controlled output can reach command construction where validate: guards are absent and the substitution layer does not quote it.

// Bind a `run capture:<spec>` from a command's stdout into one or more {{vars}}.

The copy directive's from-branch path git-fetches a remote branch (origin by default, or a remote selected via NANOCLAW_CHANNELS_REMOTE/NANOCLAW_REGISTRY_REMOTE) and writes files from that mutable remote into the install root, installing remotely-controlled content that the agent app then imports.

await exec(gitFetchBranchCommand(remote, b));

env-set directives substitute collected variables, including secret-flagged prompt values, into KEY=value lines appended to the install root .env, persisting credentials in plaintext as part of skill wiring.

const value = substitute(entry.slice(eq + 1).trim(), vars); // throws if a {{var}} is unresolved

The sandbox-image step executes the artifact's registry-login bash script (REGISTRY_LOGIN_SCRIPT, value defined outside the shown range) via runInheritScript as a child process, performing a device-flow sign-in whose disclosed record sent to the remote registry service is the operator's email address plus an image-fetch event.

const code = await runInheritScript('bash', [REGISTRY_LOGIN_SCRIPT]);

The setup driver reads SLACK_BOT_TOKEN from the process environment and the project .env — a capability undeclared anywhere for this provider-setup artifact — though it only presence-checks the value to decide whether to offer Slack onboarding, with no sink shown.

!(process.env.SLACK_BOT_TOKEN || readEnvKey('SLACK_BOT_TOKEN'))?.trim()

The setup infrastructure fetches and imports executable code from a mutable remote git branch at runtime (the channels branch / from-branch registry branch, resolved as any remote carrying the branch) rather than a pinned commit, e.g. materializing src/provisioning/slack-app.ts via git fetch + git show and dynamically importing the fetched .ts, and copying the GitHub adapter in from the channels branch.

materialize that one file from the channels branch exactly

When src/provisioning/slack-app.ts is absent, the Slack pre-step resolves a git remote (NANOCLAW_CHANNELS_REMOTE override, else origin preferred), git-fetches the mutable channels branch head, writes src/provisioning/slack-app.ts into the tree, and dynamically imports and executes it, so Slack setup runs unpinned remote code fetched at runtime.

exec(gitFetchBranchCommand(resolved, CHANNELS_BRANCH));

setup/container.ts invokes sudo to start the Docker service and to add the current user to the docker group (root-equivalent through the docker socket), then re-executes itself under sg docker as part of setup without a separate consent step.

spawnSync('sudo', ['usermod', '-aG', 'docker', process.env.USER ?? ''], {

The add-cursor setup entry point invokes an undeclared launchSlackJob() Slack routine before running the declared Cursor-provider setup steps, a capability the skill's declared purpose does not account for (unexplained, not concealed).

await launchSlackJob(); await main();

Undeclared for the add-cursor skill: setup writes a docker-credential-nanoclaw executable into /usr/local/bin or ~/.local/bin and rewrites ~/.docker/config.json — a file that can hold every registry credential on the machine — so Docker routes one registry's credentials through the installed helper.

writeExecutable(helperPath, renderHelper(fs.readFileSync(helperSourcePath(), 'utf-8'), process.execPath))

setup/install-cred-helper.ts writes an executable docker-credential-nanoclaw into /usr/local/bin or ~/.local/bin, wires it into ~/.docker/config.json credHelpers to handle registry credentials for the pinned registry, and executes the installed binary to verify it, leaving a credential-handling executable on PATH that persists outside the project tree.

writeExecutable(helperPath, renderHelper(fs.readFileSync(helperSourcePath(), 'utf-8'), process.execPath));

The setup installs a docker-credential-nanoclaw binary onto PATH and rewrites ~/.docker/config.json credHelpers to route registry credential lookups through it, a host configuration change that persists beyond the task and affects docker's credential resolution machine-wide for the wired registry.

Wiring is one `credHelpers` key in `~/.docker/config.json`, read-modify-write

Bundled prerequisite installer scripts (Docker, Node, Claude CLI) execute pipe-to-shell downloads and sudo at run time, deliberately packaged as single allowlisted script units so the agent's permission allowlist approves the whole download-and-execute as one file before the task runs.

The script itself is the allowlisted unit; the pipes and sudo live inside

Undeclared by the skill: the installer creates node/npm/npx/pnpm symlinks under ~/.local/bin and prepends that directory to PATH, altering host shell configuration outside the declared Cursor-provider scope.

ln -sf ~/node/bin/node ~/.local/bin/node

Undeclared and disclosed only in a comment: install-node.sh is deliberately structured so permission pre-approval matches only the allowlisted script file while its sudo and piped-remote execution run inside it where the approval mechanism cannot inspect what is executed.

The script itself is the allowlisted unit; the pipes and sudo live inside

The signal-cli installer downloads a GitHub release tarball and stages a chmod +x binary into ~/.local/bin/signal-cli, placing an executable on the user's PATH; the download is checksum-pinned to a hardcoded sha256.

chmod +x 

The setup flow captures the user's live provider OAuth token by running the interactive `claude setup-token` login under script(1) and parsing the PTY capture to recover the sk-ant secret for storage.

Extract the Claude OAuth token from a PTY capture of `claude setup-token`

When the Claude CLI is missing, ensureClaudeReady executes the not-shown setup/install-claude.sh installer via spawnSync after a confirm prompt that defaults to Yes, running an unseen prerequisite installer on the host.

spawnSync('bash', ['setup/install-claude.sh'], {

ensureClaudeReady runs claude setup-token under script(1), writes the PTY capture to a temp file in os.tmpdir(), regex-extracts the sk-ant-oat OAuth token, and stores it in process.env.CLAUDE_CODE_OAUTH_TOKEN, leaving the credential on disk until a best-effort unlink.

const token = extractClaudeOAuthToken(fs.readFileSync(tmpfile, 'utf-8'));

Undeclared by the skill: the assistant executes a bash command parsed from a Claude model reply via setup/run-suggested.sh, gated only by an operator confirm-with-edit prompt.

const child = spawn('bash', [script, command], {

buildHandoffPrompt labels the collected setup values 'secrets redacted' but embeds each key and value verbatim into the prompt handed to the spawned Claude session, so any secret not redacted upstream would be handed to the model; the redaction the label promises is not performed in this code.

lines.push('Values collected so far (secrets redacted):');

The setup driver performs undeclared telemetry: it sends a persistent install identifier (data/install-id as distinct_id) plus platform and event properties to the third-party collector us.i.posthog.com, which no declaration for this skill covers (an opt-out env var exists but the egress itself is undeclared).

void fetch(POSTHOG_URL, {

The restart script loads the tool's LaunchAgent plist into launchd via launchctl bootstrap, activating the persistent per-user service job.

launchctl bootstrap

The setup runner emits host setup-activity telemetry (step names, durations, abort reasons) via phEmit calls whose destination and payload handling are not defined in the shown code, so setup metadata leaves the host to an unknown sink.

phEmit('step_started', { step: stepName });

Setup persists a fallback git identity into the checkout's local git config and auto-commits skill-apply changes plus rewrites the upgrade-state marker — host-config writes undeclared by the provider-wiring purpose (unexplained residue, disclosed only in code comments and scoped to this checkout).

for (const [key, value] of missing) git(root, ['config', '--local', key, value]);

The skill driver executes arbitrary SKILL.md-authored commands via bash -c with the full process environment plus a PATH-prepended project bin/ — an execution channel broader than the declared ncl wiring whose actual command set for this skill lives in the not-shown SKILL.md (declared core mechanism, hence contextual only).

const child = spawn('bash', ['-c', cmd], {

The setup peer-cleanup preflight enumerates other NanoClaw launchd/systemd user services in the user's home, unloads or disables them via launchctl/systemctl when it judges them dead or crash-looping, and force-deletes their plist/unit config files outside the workspace.

fs.rmSync(peer.configPath, { force: true });

Undeclared for the Cursor-provider purpose: the setup portal client labels the machine with the local hostname and current directory name for the community-portal sign-in flow toward portal.nanoclaw.dev, sending local host data off-host that the declaration does not mention.

label: `${os.hostname()} · ${path.basename(process.cwd())}`,

The setup portal flow registers this machine's device identity with an external service (https://portal.nanoclaw.dev by default, origin overridable via NANOCLAW_PORTAL_ORIGIN), sending registration data off-host during setup.

await client.register();

After applying a provider skill the setup step dynamically imports the freshly written provider module (./providers/<name>.js) and newly appended host contract modules, executing just-installed code inside the host process.

await import(installedModule);

The provider install pipeline runs dependency commands declared by the applied SKILL.md through execSync in the project root, executing skill-defined shell commands on the host during provider install.

exec: (cmd) => execSync(cmd, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8' }),

Unexplained (undeclared) relative to the add-cursor provider-install description: the setup register step rewrites the registered agent group's CLAUDE.md agent persona/rules file in place, though it is scoped to the freshly registered group's own file and guarded by existence and content-diff checks.

const mdFile = path.join(projectRoot, 'groups', parsed.folder, 'CLAUDE.md');

The register step rewrites the freshly registered agent group's CLAUDE.md rules file, replacing the 'You are Andy' persona instructions with a caller-supplied assistant name, an agent control-plane content write.

fs.writeFileSync(mdFile, after);

Undeclared residue: the driver prompts the user to opt into NanoClaw/Echo marketing email (confirm defaulting to yes) and POSTs the answer with the account token to the broker's /v1/account/preferences — an email-consent collection the add-cursor skill's declared description does not cover.

json({ email_updates: optIn, consent_version: CONSENT_VERSION, source: 'cli' }, cred.token),

On sign-in the driver persists the account token to 0600 files under ~/.config/nanoclaw and invokes installCredentialHelper to wire a docker credential helper for the registry host, modifying host docker credential configuration.

wireDockerCredentialHelper(record.registry);

Undeclared residue: the sign-in driver enrolls machine metadata (os, arch, nanoclaw_version, per-machine host_id) and, on the browser path, the WorkOS access token to the operator-resolvable NanoClaw broker via POST /v1/enroll (plus /v1/session/probe and /v1/auth-config), a network capability absent from the add-cursor skill's declared description.

res = await http(`${api}/v1/enroll`, json(enrollWire(body)), HTTP_TIMEOUT_MS);

Undeclared residue R31: this NanoClaw setup sign-in driver hardcodes and uses WorkOS device-flow endpoints at api.workos.com (overridable via NANOCLAW_WORKOS_* env) for OAuth sign-in — network identity traffic that the add-cursor skill's declared description never declares, though the code documents it openly.

const DEFAULT_DEVICE_ENDPOINT = 'https://api.workos.com/user_management/authorize/device';

The device sign-in flow spawns the platform browser opener (open/xdg-open/wslview/cmd.exe) detached with a URL taken verbatim from the registry's device-authorization response, executing remote-influenced input as a command.

spawn(cmd[0], cmd[1], { stdio: 'ignore', detached: true })

The NanoClaw docker credential helper is installed as a standalone binary on PATH that is designed to survive uninstall (the checkout is deleted but the file stays on PATH), with ~/.docker/config.json credHelpers routing registry pulls to it, leaving an executable credential-vending path outside the product tree.

uninstalling NanoClaw deletes the checkout while this file stays on PATH

setup/run-suggested.sh runs commands suggested by the claude-assist agent through an eval inside an allowlisted script, with the guarantee that the user saw and confirmed the command asserted only in comments and delegated to unseen callers.

caller has already shown the command to the user and gotten confirmation.

The setup service step pre-stamps an upgrade marker before first host start so the startup tripwire (enforceUpgradeTripwire) treats the install as sanctioned, i.e. the installer self-certifies past a safety check rather than being validated by it.

tripwire (enforceUpgradeTripwire) sees this as a sanctioned install

The nohup fallback writes a mode-0755 start-nanoclaw.sh into the project and executes it with /bin/bash, launching dist/index.js detached via setsid/nohup so the agent host keeps running after the setup terminal exits.

execFileSync('/bin/bash', [wrapperPath], { cwd: projectRoot, stdio: 'pipe', timeout: 15_000 });

The Slack setup worker sends the job's identity token as a Bearer credential in a POST to the network origin recorded in the local Slack job file (restricted to https or loopback), carrying the credential off-host to whatever service that job names.

authorization: `Bearer ${job.identity.token}`

The Slack provisioning worker, unrelated to the declared Cursor-provider purpose, sends setup status (appId, setupId, status) to a slackProgressClient service whose base URL is not shown in this batch and exchanges Slack bot tokens over the network with an origin-validated https/localhost service — undeclared network egress/ingress for this skill, contextual because it belongs to the Slack channel's own opt-in provisioning flow.

await slackProgressClient(current).request('POST', '/api/v1/device/slack', {

Undeclared by the add-cursor description (which declares only provider wiring via ncl), the bundled setup ships an uninstaller that unloads launchd/systemd services, kills PIDs from pidfiles, pkill-matches host processes, force-removes containers/images/volumes/networks, deletes symlinks and the .env secrets file (backed up first), and recursively force-deletes install paths including user data directories — capability is plainly visible and scoped to its own install slug, so it is unexplained rather than concealed residue.

fs.rmSync(action.item.path, { recursive: true, force: true });

Undeclared by the add-cursor Cursor-provider description, the bundled setup ships a WhatsApp channel-auth step whose version resolver makes an outbound HTTPS GET to the third-party tracker wppconnect.io; it sends no local message or credential data, so it does not actually break the per-channel local-only claims (D79/D83/D100/D113/D221), but the third-party network contact itself is covered by no declaration and is therefore unexplained residue, plainly visible in code.

const res = await fetch(TRACKER_URL, { signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) });

Undeclared for the add-cursor provider skill: launchSlackJob copies the entire process environment into a detached child process running setup/slack-worker.ts, exposing every ambient environment token to that spawned worker (residue R40 adjudicated as unexplained, not concealed).

const env = { ...process.env };

launchSlackJob spawns a detached, fully silent background Node process that executes the repository script setup/slack-worker.ts via tsx with the full inherited environment, hiding the worker's execution from the user while its behavior is not shown in this pass.

spawn(process.execPath, ['--import', 'tsx', path.join(root, 'setup/slack-worker.ts')], {

queueSlackJob copies the NanoClaw install token from the account file plus the Slack app/bot token snapshot from data/community-portal.json into data/slack-install.json (0600 via writePrivate), duplicating live credentials into a second on-disk file consumed by the detached worker.

token: account.token,

Undeclared residue: resolveProviderContribution passes the entire host environment (hostEnv: process.env) into provider host-adapter context, broader than the declared design in which the Cursor API key is held only by the credential gateway; the code is plainly visible (unexplained, not concealed) and no sink for the environment values is shown in this batch.

hostEnv: process.env,

buildAgentGroupImage interpolates central-DB-stored apt/npm package lists into Dockerfile RUN shell lines and executes a container-image build on the host runtime, deliberately allowlisting unpinned npm packages' postinstall install-time scripts.

pnpm install -g ${npmPackages.join(' ')}

materializeTemplateSkills copies template skill trees from the group shared store into each provider per-group skills directory (including the store mounted where Claude reads ~/.claude/skills), planting skill content that agents load and execute and that persists across respawns.

copyTree(srcSkill, destSkill, 0);

SqliteAgentMailbox.destroy force-deletes a session's inbound and outbound mailbox SQLite files plus journal/shm/wal sidecars at paths built by joining agentGroupId/sessionId key parts under DATA_DIR, wiping that session's mailbox data.

fs.rmSync(`${db}${suffix}`, { force: true })

The host code rewrites Claude Code's settings.json — disabling auto-memory and registering a PreCompact hook that runs 'bun /app/src/compact-instructions.ts' — an agent control-plane write that the add-cursor/add-codex skill claims (setup screens and step sequence unchanged; installed is not authenticated and the default provider stays claude) neither declare nor cover, though the write itself is a visible, symlink-guarded reconcile that does not literally alter setup screens or the provider default.

dir.replaceFile(CLAUDE_SETTINGS_FILE, result.content)

The portal runtime auto-launches a locally saved Slack install worker via launchSlackJob whenever the check loop runs after the remote cell link marks state dirty, gated only on the saved job's deviceId/install_id/account_id/origin matching the local identity, so a remote snapshot change triggers local execution of a worker whose code is not shown.

if (await launchSlackJob(root)) log({ event: 'slack_install_resumed', deviceId: current.deviceId });

The community-portal runtime reads the install identity (token/account/install ids) and the device key from the host home directory on every tick and uses them to authenticate a persistent outbound DeviceClient/CellLink to an origin read from the local state file data/community-portal.json, so stored host credential material continuously authenticates a network channel whose destination is whatever origin the state file names.

const account = local?.deviceId && local.origin ? await readInstallIdentity({ homeDir }) : null;

applyAddMcpServer writes an agent-supplied MCP server configuration into the container's mcp_servers map in the control-plane database and kills/respawns the container so the new server's tools load into the agent after admin approval.

servers[name] = serverConfig;

applyInstallPackages writes agent-supplied apt/npm package names into the container config database and then rebuilds the image and kills/respawns the container, installing and making those packages executable in the agent runtime once an admin approves the card (guard holds container-originated requests for admin approval).

await updateContainerConfigJson(agentGroup.id, 'packages_apt', existing);

The self-modification pipeline stores the agent-supplied install_packages/add_mcp_server payload verbatim in the database and runs it through shell execution and a container image rebuild on apply, so an agent-initiated request (gated by a single admin approval card) results in the container executing agent-chosen package installs and wiring new MCP servers.

verbatim through to shell exec on apply

The provider-surface realization writes agent control-plane files on the host on group init and every spawn — creating group directories, composing the CLAUDE.md project document into group state, reconciling provider settings files via registered transformers, and planting skill symlinks pointing at /app/skills inside the agent-visible skills directory.

writeAtomic(path.join(groupDir, spec.fileName), content)

Provider host contracts allow a payload to declare its own modelDomains and HTTPS modelEndpoints — documented as provider-owned URLs used by gateway credential adapters and exempt from default gateway approval — validated only against the same payload's declared domains, so the Cursor payload's own declarations determine which hosts can receive credential-bearing gateway traffic.

modelEndpoints must use HTTPS within declared modelDomains