add-github

The Codex payload's contract and provider modules write config.toml and hooks.json for the agent runtime before every query and apply hook trust non-interactively, planting runtime configuration and hooks the operator never approves.

the provider's own direct write must stand down

On every query the provider rewrites the Codex agent's ~/.codex/hooks.json to register a SessionStart command hook running bun /app/src/memory/hook.ts, a persistence write into an agent control-plane config.

hooks: [{ type: 'command', command: memorySessionHook.command, timeout: 10 }],

The add-codex skill instructs the agent to overwrite the host, container, and setup source trees with its payload directory, installing the runtime code that hardcodes danger-full-access, approval_policy never, and unconditional auto-approval into the agent runner.

Copy the Codex payload from this skill's `payload/` into all three trees (additive — overwrite each file).

Undeclared residue (R65, adjudicated unexplained): the add-teams skill instructs a host configuration write, `npm config set prefix ~/.npm-global`, as a conditional EACCES fallback — a change to the user's npm prefix configuration that the declared channel-integration purpose does not require, though it is disclosed in prose.

npm config set prefix ~/.npm-global

Undeclared for a GitHub-channel integration skill: the bundled Claude provider enumerates the agent's own SDK transcripts under ~/.claude/projects and returns the newest one for the /upload-trace diagnostics lookup, a sensitive transcript read the declared purpose does not explain.

const projects = path.join(os.homedir(), '.claude', 'projects');

container/install-cli-tools.sh derives a pnpm only-built-dependencies policy file from the runtime-extended manifest and writes it to /root/.npmrc, re-enabling install-time build scripts that pnpm otherwise skips.

require(

container/install-cli-tools.sh runs as root and executes `pnpm install -g` for every package listed in a manifest that skills extend at runtime, so a skill-added entry with a native postinstall gets its build script executed on the host.

pnpm install -g 

docs/upgrade-recovery.md instructs coding agents to run the upgrade-state override command automatically and to stop only if the upgrade failed, clearing the host's supported-path tripwire without pausing for user confirmation — an instruction beyond the add-github skill's declared purpose, though guarded by the document's own completion conditions.

run the command above automatically and restart

The Photon setup flow exchanges device codes with the configured dashboard host, then persists the returned OAuth access token via saveAuth to an undisclosed on-disk location and writes PHOTON_PROJECT_SECRET into the project .env.

saveAuth({ access_token: token });

The headless skill-refresh path executes nc:run directive bodies — shell commands with {{var}} substitution defined in installed skills' SKILL.md documents — via execSync in the repository root, giving any skill document on disk code execution during refresh.

return execSync(command, {

When the Docker socket returns permission-denied on Linux, setup re-executes itself under `sg docker -c pnpm run setup:auto` to regain docker-group (root-equivalent) access — conditional and warned, but an undeclared privilege-context change relative to the declared add-GitHub-channel purpose.

spawnSync('sg', ['docker', '-c', 'pnpm run setup:auto'], {

The setup harness reads the SLACK_BOT_TOKEN environment variable (process env and .env) to decide whether to offer Slack channel setup — undeclared residue for a skill whose declared purpose is adding a GitHub channel; the value is only tested for presence, not transmitted, in the reviewed code.

!(process.env.SLACK_BOT_TOKEN || readEnvKey('SLACK_BOT_TOKEN'))?.trim()

Setup installs NanoClaw as a persistent per-user launchd/systemd background service that relaunches the assistant across sessions, referenced here via launchctl bootstrap of a ~/Library/LaunchAgents/<label>.plist and systemctl --user restart of the unit.

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/${label}.plist

Setup emits telemetry events (first-chat results, provider/channel/image-source choices, completion status and durations) through phEmit to a destination not shown in the reviewed units — undeclared in the reviewed material for a GitHub-channel skill.

phEmit('setup_completed', { duration_ms: Date.now() - RUN_START });

The channel setup harness reads and executes skills from .claude/skills/<name> via runSkill (applying their SKILL.md directives, with service restarts) for any registered companion channel — undeclared residue for a GitHub-channel skill, though plainly visible and not hidden.

const res = await runSkill(`.claude/skills/${skill}`, {

During Slack channel setup, loadProvisioningCore fetches a TypeScript module from the mutable 'channels' branch of a git remote chosen by resolveChannelsRemote (or the NANOCLAW_CHANNELS_REMOTE env override), writes it into the tree via git show, and executes it with a dynamic import, so whatever code that remote serves at run time runs inside the setup process that holds .env credentials and broker tokens.

exec(gitFetchBranchCommand(resolved, CHANNELS_BRANCH));

Undeclared by the artifact's stated purpose, the container setup step auto-runs the repository script setup/install-docker.sh via bash with inherited stdio whenever the docker binary is missing — an auto-run prerequisite installer whose payload is not part of the reviewed units.

execSync('bash setup/install-docker.sh', { cwd: projectRoot, stdio: 'inherit' });

Undeclared residue: setup installs an executable docker credential helper into /usr/local/bin or ~/.local/bin and rewrites the credHelpers key of ~/.docker/config.json — host credential configuration the declared GitHub-channel purpose does not mention, though the code shown handles it read-modify-write without writing secrets.

Wiring is one `credHelpers` key in `~/.docker/config.json`, read-modify-write

The cred-helper install writes a credHelpers pointer into ~/.docker/config.json and places an executable docker-credential-nanoclaw on PATH so docker routes registry credential payloads to helper code (setup/registry/credential-helper.mjs) that is not among the reviewed units.

credHelpers[registryHost] = CRED_HELPER_NAME;

Undeclared residue: the Node installer creates node/npm/npx/pnpm symlinks in ~/.local/bin and prepends that directory to PATH, host PATH manipulation beyond the declared GitHub-channel purpose.

ln -sf ~/node/bin/node ~/.local/bin/node

setup/lib/captured-token.ts recovers the operator's Claude OAuth token (sk-ant-oat) from a PTY capture of `claude setup-token` and prints it to stdout for the setup driver to reuse.

Extract the Claude OAuth token from a PTY capture of `claude setup-token`,

Undeclared prerequisite installer: ensureClaudeReady executes the unshown setup/install-claude.sh via bash after a default-yes confirm whenever the Claude CLI is missing (C618), running installer content this artifact does not disclose (D59 is not actually contradicted).

spawnSync('bash', ['setup/install-claude.sh'], {

Undeclared for this skill's stated purpose, ensureClaudeReady captures the user's Claude OAuth token from a PTY capture of the consented claude setup-token run and writes it into process.env.CLAUDE_CODE_OAUTH_TOKEN (R14), an unexplained credential-handling chain (capture file to extractor regex to env write) in a GitHub-channel skill.

if (token) process.env.CLAUDE_CODE_OAUTH_TOKEN = token;

Undeclared execution path: the setup hands a Claude-authored shell command to the unshown helper setup/run-suggested.sh via bash (C623), gated only by an editable confirm, so model-suggested commands run on the host (D59 is not actually contradicted).

spawn('bash', [script, command], {

Setup emits fire-and-forget telemetry events, joined by a persistent install identifier, to the third-party PostHog analytics service, with opt-out only via NANOCLAW_NO_DIAGNOSTICS=1.

Thin PostHog emitter shared across setup:auto code.

Undeclared telemetry: the setup harness POSTs a persistent install UUID, platform, and caller-supplied event properties to https://us.i.posthog.com on every run unless NANOCLAW_NO_DIAGNOSTICS=1, contradicting the declared claim that no third-party service is involved and nothing leaves the machine (R15/C489).

void fetch(POSTHOG_URL, {

The skill's shared setup infrastructure reads and manages a bearer-token registry account file under ~/.config/nanoclaw (account.json and registry-auth.json, plus the docker credential-helper view) and resolves a remote account broker at https://registry.nanoclaw.dev — a credential-handling capability that the declared GitHub-channel-integration purpose does not declare; it is unexplained but openly visible, hence contextual risk.

export const DEFAULT_BROKER_URL = 'https://registry.nanoclaw.dev';

The registry account flow stores the broker-minted bearer token in plaintext under ~/.config/nanoclaw/account.json and reads it back for docker credential-helper use, with the broker defaulting to a compiled-in constant (DEFAULT_BROKER_URL) that can be overridden per install.

return typeof account.token === 'string' && account.token ? account : undefined;

Setup commits the skill-apply's changes into the operator's git checkout using execFileSync('git', ...) with a synthetic fallback identity ('NanoClaw setup <setup@nanoclaw.invalid>') and, per its own comments, makes machine-made local commits with no hooks and no signing prompt — undeclared by the declared GitHub-channel-integration purpose; visible, not concealed, hence contextual risk.

['user.email', 'setup@nanoclaw.invalid'],

Undeclared residue (R18, adjudicated unexplained, not concealed): the setup auto-commit path runs git with core.hooksPath=/dev/null, commit.gpgSign=false and --no-verify, bypassing operator git hooks and commit signing while committing the files this skill's setup adds — a capability the declared 'Add GitHub channel integration' purpose does not require.

const quiet = ['-c', 'core.hooksPath=/dev/null', '-c', 'commit.gpgSign=false'];

The driver reads the project's .env credentials and rebinds values selected by document reuse:/env-set mappings into skill prompt inputs, and in non-TTY runs the reuse confirm auto-accepts, placing .env secrets into the apply flow and command arguments.

env = parseEnv(readFileSync(join(projectRoot, '.env'), 'utf8'));

The skill driver executes commands declared in a skill's SKILL.md run directives by spawning bash -c with the project's bin/ prepended to PATH, so document content becomes arbitrary host shell execution.

spawn('bash', ['-c', cmd], {

The mounts setup step writes argument- or stdin-supplied JSON (allowedRoots/nonMainReadOnly) to ~/.config/nanoclaw/mount-allowlist.json outside the workspace, configuring which host directories containers may mount, so permissive input widens host exposure to containers.

fs.writeFileSync(configFile, JSON.stringify(parsed, null, 2) + '

Setup preflight cleanup enumerates sibling NanoClaw launchd plists in ~/Library/LaunchAgents and systemd units in ~/.config/systemd/user and, when their launch target is missing or the service is crash-looping, runs launchctl unload / systemctl --user disable --now and deletes their service config files with fs.rmSync outside any build or cache directory.

fs.rmSync(peer.configPath, { force: true });

The portal setup flow passes server-returned URLs (setup.url/flow.url from SetupClient.start) to an opener that builds `open`/`xdg-open`/`wslview`/`cmd.exe start` shell commands with execSync and only JSON.stringify quoting, so shell substitution such as $( ) inside a malicious or compromised portal URL would execute arbitrary commands on the host.

execSync(`open ${JSON.stringify(url)}`, { stdio: 'ignore' });

Setup portal flows send device/account state requests to portal.nanoclaw.dev during setup — undeclared network communication for a skill whose declared purpose is adding a GitHub channel integration.

process.env.NANOCLAW_PORTAL_ORIGIN ||= 'https://portal.nanoclaw.dev';

The portal client configures a SetupClient labeled with the machine hostname and current-directory basename and contacts https://portal.nanoclaw.dev (origin overridable via NANOCLAW_PORTAL_ORIGIN) for device registration, sign-in flows, and perk state, sending host-identifying metadata off-host during setup enrollment.

label: `${os.hostname()} · ${path.basename(process.cwd())}`,

The setup provider-install path dynamically imports and executes modules that the install engine just wrote into the checkout — undeclared code execution for a skill whose declared purpose is adding a GitHub channel integration.

for (const file of modules) await import(pathToFileURL(file).href);

The provider installer runs shell commands derived from the applied SKILL.md via an execSync callback (including sourcing setup/lib/channels-remote.sh under /bin/bash) and then dynamically imports the freshly appended provider-contract modules into the running setup process, so any injected or manipulated skill content executes on the host.

exec: (cmd) => execSync(cmd, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8' }),

The channel registration step rewrites the agent rules/memory file groups/<folder>/CLAUDE.md via find-and-replace of the assistant name, modifying agent instruction content on disk gated only by the unshown isValidGroupFolder check on --folder.

fs.writeFileSync(mdFile, after);

Residue R23 adjudicated unexplained and undeclared: the consent text displays the external host nanoclaw.dev as the data-use contact for collected email addresses; it is a displayed link, not a network fetch, and the email-consent flow itself is undeclared for the skill's purpose.

What we do with your address: https://nanoclaw.dev/privacy

Sign-in persists long-lived account/registry tokens under ~/.config/nanoclaw and rewrites docker's credential-helper wiring plus the install's image-source state — host-config persistence and credential storage that the declared GitHub-channel purpose does not cover.

wireDockerCredentialHelper(record.registry);

The sign-in driver generates a per-machine host id, packs it with OS/arch/version into the client record, and POSTs it to a broker URL taken from NANOCLAW_REGISTRY_API/.env/--api during enrollment, together with the WorkOS IdP access token on the browser path.

const common = { ...body, install_id: body.client.host_id };

The artifact's registry sign-in driver contacts api.workos.com (WorkOS AuthKit device flow) and the NanoClaw broker, exchanging device/account identifiers (host-id, install_id) for an account token — network egress residue (R22) that is unexplained, not concealed, and not declared by the skill's stated purpose of adding a GitHub channel integration.

const DEFAULT_DEVICE_ENDPOINT = 'https://api.workos.com/user_management/authorize/device';

The sign-in driver persists registry tokens under ~/.config/nanoclaw and repoints docker's credential-helper configuration at them — host persistence behavior undeclared by the add-github skill's stated purpose.

const CONFIG_DIR = path.join(os.homedir(), '.config', 'nanoclaw');

The device-flow login passes the verification URL returned by a remotely configurable IdP endpoint straight to spawn (cmd.exe /c start under WSL, xdg-open/wslview/open elsewhere), so a hostile broker-controlled URL string reaches process execution via cmd.exe metacharacter parsing.

spawn(cmd[0], cmd[1], { stdio: 'ignore', detached: true })

The registry reconcile step spawns docker rmi to delete derived agent-group images identified by its own tag pattern, clearing DB pins first and skipping operator-supplied images.

const rmi = spawnSync(CONTAINER_RUNTIME_BIN, ['rmi', derivedTag], { encoding: 'utf-8' });

The registry refresh step spawns bash on container/pull.sh from the project root, chaining setup into execution of a script whose contents are not in evidence and which acquires and retags remote image bytes.

const pull = spawnSync('bash', [path.join(projectRoot, 'container', 'pull.sh')], {

The setup contacts the credential broker over the network to delete a registry session using the stored bearer token — an undeclared vendor-service call.

const res = await fetch(`${broker}/v1/session`, {

The setup machinery reads and writes a bearer-token credential file at ~/.config/nanoclaw/registry-auth.json for a gated docker image registry — an undeclared credential-handling capability for a skill that only declares adding a GitHub channel.

raw = readFileSync(AUTH_FILE, 'utf-8');

The docker credential helper reads the locally stored registry bearer token and posts host metadata (OS, CPU arch, node version, install id, pull digest) with that token to a broker URL taken from a local config file to mint registry credentials — undeclared vendor network contact.

res = await fetch(`${brokerBase(auth)}/v1/credentials`, {

The setup helper script takes a caller-supplied command string in argv, has the user press Enter on a pre-filled readline, and evals it in the user's shell, so an agent-suggested command executes with full shell semantics after a single keystroke.

eval

A setup helper script evals commands suggested by the claude-assist agent, gating execution only on a readline Enter prompt and an unverifiable claim that the caller already confirmed the command with the user.

This script is the allowlisted unit — the `eval` happens inside.

The run-suggested script's comment asserts the unverifiable precondition that a caller already showed the command to the user and obtained confirmation, which is the only stated guard on its eval of agent-suggested commands.

# caller has already shown the command to the user and gotten confirmation.

The setup symlinks its ncl CLI into ~/.local/bin so the binary stays on the user's PATH after setup — an install footprint beyond the declared channel integration.

fs.symlinkSync(source, target);

The setup installs a launchd LaunchAgent plist with RunAtLoad and KeepAlive into ~/Library/LaunchAgents and loads it with launchctl so the NanoClaw host auto-starts at every login and keeps restarting — host persistence the skill's declared channel-integration purpose does not cover.

writeOwnerOnly(plistPath, plist);

The setup writes and enables a systemd unit (Restart=always, loginctl enable-linger) or a detached setsid nohup wrapper to keep the NanoClaw host running across sessions and logouts — persistence not declared by the skill.

fs.writeFileSync(unitPath, unit);

The setup step detects, unloads, and removes other NanoClaw peer services (e.g. the legacy com.nanoclaw plist) before installing its own service — manipulation of other installed services that the skill does not declare.

const peerReport = cleanupUnhealthyPeers(projectRoot);

The nohup fallback writes a 0755 start-nanoclaw.sh wrapper into the project and executes it with /bin/bash, launching a setsid nohup-detached daemon of the checkout's dist/index.js that survives the setup terminal.

execFileSync('/bin/bash', [wrapperPath], { cwd: projectRoot, stdio: 'pipe', timeout: 15_000 });

The shipped setup harness spawns the external signal-cli binary (account listing, version probe, and a blocking `link` device-pairing flow) — an undeclared EXEC capability for a skill declared as GitHub channel integration; it is plainly documented in code, so unexplained rather than concealed (adjudicated contradiction leads C691-C693 against D59 are not real contradictions, since D59 concerns the iMessage better-sqlite3 dependency).

spawn(cli, ['link', '--name', DEFAULT_DEVICE_NAME], {

The Slack worker sends bearer-authenticated POSTs carrying app identifiers to the remote origin configured in job.serviceBase and receives a Slack bot token back — undeclared network egress for a skill declared as GitHub channel integration; the origin is validated to https or localhost and nothing is hidden, so this is unexplained residue, and the claimed contradiction with D30/D34/D69/D82/D190 (other channels) does not hold.

const response = await fetch(`${base.origin}/v1/apps/${encodeURIComponent(job.app.appId)}/install`, {

The Slack worker dynamically imports and executes runChannelSkill('slack', ...) feeding it provisioned bot_token/app_token secrets — an undeclared code-execution path for the GitHub-declared purpose, plainly visible in code and therefore unexplained rather than concealed.

const { runChannelSkill } = await import('./channels/run-channel-skill.js');

runSlackJob persists a lock file and a private Slack job file storing the delivered xoxb- bot token, and reports setup status to the remote slackProgressClient endpoint — undeclared persistence and status egress for the GitHub-declared purpose, plainly visible; the paired D14/D21 contradictions are not real (those claims concern setup UI stability and the codex default, not absence of writes).

const save = () => writePrivate(slackJobFile(root), job);

Residue R28 adjudicated unexplained: the setup timezone step reads and rewrites the project .env to persist TZ — a file-modification capability the declared GitHub-integration purpose does not state, but it is plainly visible and not concealed, and the paired D14/D21 contradictions do not hold (those claims address UI stability, not file writes).

fs.writeFileSync(envFile, content);

The shipped uninstall flow can recursively delete app data, agent memory (groups/), logs, node_modules and .env, kill the host process, unload launchd/systemd services, and remove containers/volumes/networks — with a --yes mode that skips all confirmations — a destructive capability undeclared by the GitHub-declared purpose; it is gated by default-No prompts and plainly documented, so unexplained rather than concealed, and the paired D59/D14 contradictions do not hold.

p.log.warn('--yes given: deleting everything found below without asking.');

Residue R29 adjudicated unexplained: the uninstaller copies the credential-bearing .env to .env.bak (checking for an existing .env.bak first) before deleting the original — undeclared credential-file handling for the GitHub-declared purpose, plainly visible and not concealed.

fs.copyFileSync(envPath, backup);

The GitHub-channel skill ships a complete WhatsApp Baileys linking flow that connects the machine to WhatsApp as a companion device (makeWASocket) and persists linked-device credentials under store/auth/, an undeclared capability for its stated purpose — unexplained rather than concealed.

const sock = makeWASocket({

CellLink maintains a reconnecting WebSocket to the configured portal origin and feeds every inbound frame into mux.receive and host callbacks (onSnapshot/onChange), giving the remote portal a standing trigger into host behavior whose callback actions are not shown in these units.

const frame = mux.receive(event.data);

The undeclared community-portal Slack installer copies the host's entire process environment into a detached Slack worker child process (the declared purpose covers only adding a GitHub channel), which can carry unrelated host secrets into a long-lived background process; the capability is visible, not concealed.

const env = { ...process.env };

The Slack setup flow persists Slack app/bot tokens and the user's account identity token into a private job file and then silently spawns a detached child process running setup/slack-worker.ts via tsx with an inherited copy of the host environment, creating an unsupervised credential-bearing execution path whose destination code is not shipped in the reviewed units.

spawn(process.execPath, ['--import', 'tsx', path.join(root, 'setup/slack-worker.ts')]

The Slack install job persists an identity snapshot and a detached tsx worker (setup/slack-worker.ts) that applies the Slack channel skill is spawned after workspace approval, resumed after host restart, and gated against duplicate spawn on cell updates, an auto-run setup process whose payload is not present in the shown units.

Start the detached worker for a saved job that still has work to do.

Undeclared residue R32 (unexplained, not concealed): resolveProviderContribution builds its provider context with hostEnv: process.env, handing the entire host process environment, including any credential-bearing variables, to provider adapter code (fn(context)/legacyOverlay), an all-env access the declared purpose of adding a GitHub channel integration does not declare.

hostEnv: process.env,

Undeclared residue R33 (unexplained, not concealed): the spawn path composes a per-group CLAUDE.md instruction document on the host (composeGroupProjectDoc) and mounts it read-only into every agent container at /workspace/agent/CLAUDE.md, an agent control-plane instruction-file write that the declared GitHub-channel purpose does not declare.

containerPath: projectDocument?.containerPath ?? '/workspace/agent/CLAUDE.md',

buildAgentGroupImage reads packages_apt/packages_npm JSON from the central DB, interpolates them and the agentGroupId unsanitized into Dockerfile RUN lines (line 1627/1634/1635) and into the host shell command docker build -t ${imageTag} -f ${tmpDockerfile} executed via execAsync (line 1659), so a malicious DB-stored package name or group id executes arbitrary shell commands during image build.

RUN apt-get update && apt-get install -y ${aptPackages.join(' ')}

Undeclared residue (R35): configuredDriverKind reads the NANOCLAW_RUNTIME_DRIVER setting from process.env, environment access not covered by the declared GitHub channel-integration purpose and not concealed but also not declared.

env: NodeJS.ProcessEnv = process.env

Undeclared residue (R36): mountPolicy reads the NANOCLAW_SESSION_MATERIAL_ROOT setting from process.env/.env while deriving host mount roots, an environment-access capability the declared GitHub channel-integration purpose does not declare.

materialsRoot: readSetting('NANOCLAW_SESSION_MATERIAL_ROOT', env) || path.join(DATA_DIR, 'session-materials'),

Undeclared residue (R34): src/drivers/index.ts reads host settings from process.env and the .env file via readSetting, an environment-access capability the declared GitHub channel-integration purpose does not declare, though the read is confined to a fixed two-key allowlist (NANOCLAW_RUNTIME_DRIVER, NANOCLAW_SESSION_MATERIAL_ROOT) rather than all env as the detector lead suggested.

env: NodeJS.ProcessEnv = process.env

The SQLite task API (insertTaskRow/updateTask) writes caller-supplied `script` content into scheduled kind='task' rows that the mailbox system later runs (the 'script-skip:error' status and 'pre-task script crashed' comments confirm task scripts execute), so any caller able to influence task content gains a write-then-execute path on the host whose execution site and privileges are not shown in these units.

if (update.script !== undefined) parsed.script = update.script;

Undeclared for the declared GitHub-channel skill: the shipped code injects a PreCompact hook command (bun /app/src/compact-instructions.ts) into Claude Code settings so a bundled script auto-runs in the agent runtime, which the declared GitHub channel integration does not require.

preCompact.push({ hooks: [{ type: 'command', command: PRE_COMPACT_COMMAND }] });

Migration code documents seeding or reconciling the agent control-plane file settings.json in the Claude state directory.

Seed or reconcile `settings.json` in the Claude state directory.

Undeclared for the declared GitHub-channel skill: shipped host code seeds or rewrites Claude Code's settings.json in the Claude state directory (agent control-plane), a write adding a GitHub channel integration does not need.

dir.replaceFile(CLAUDE_SETTINGS_FILE, result.content)

On every tick the portal runtime relaunches the locally saved Slack install worker (launchSlackJob) when the remote cell link and a saved job whose identity matches the account indicate it, letting the remote portal service trigger local worker execution; the worker's implementation is not in the reviewed units.

if (await launchSlackJob(root)) log({ event: 'slack_install_resumed', deviceId: current.deviceId });

The community-portal runtime maintains a persistent remote link whose pushes trigger local reads of stored perk credentials and a saved Slack install worker, with no shown bound on where that material is subsequently used or sent.

Cell pushes only trigger a fresh read of locally saved, authorized

The community-portal runtime module, unrelated to this skill's declared GitHub-channel purpose, reads the host's install identity and device-key files from the home directory and keeps a persistent bearer-authenticated link and reconciliation channel open to a locally configured portal origin while resuming saved Slack install jobs on remote push; this capability is undeclared by the target and the remote sink implementation is not shown.

const account = local?.deviceId && local.origin ? await readInstallIdentity({ homeDir }) : null;

The community-portal runtime reads the install token (account.json) and device key (device-key.json) and transmits this identity material over bearer/WebSocket routes to a remote origin taken from the mutable local journal file, sending credential material off-host to a destination the reviewed units do not pin or validate.

token: account.token,

The mount-security validator checks only the realPath of a mount root and does not descend into it, so an operator-granted broad allowed root such as ~ or ~/.config mounts every credential beneath it (.ssh, .aws, .netrc, id_rsa) into the container regardless of the blocked-pattern list.

Allowlist `~` (or `~/.config`) and every credential below it

The mount-security module's own comments document that a read-write mount of the host's ~/.local/bin is a container-to-host code-execution primitive (drop a file, wait for the host to run it), which the root-only validator does not prevent under a broad allowed root.

directory is a container-to-host code-execution primitive: drop a file,

Task recurrence rate limiting is bypassed for any task that carries a script, permitting scheduled scripted execution at unrestricted cron frequency and enabling host resource abuse.

if (!recurrence || override || hasScript) return;

Agent-requested MCP server definitions (command, args, env) are stored verbatim in the DB and wired into the container on next start after admin approval, reaching shell execution per the module's own documentation, so a socially engineered approval yields code execution inside the agent container.

verbatim through to shell exec on apply.

On every container start the host composes and writes each agent group's CLAUDE.md rules file from host sources plus verbatim agent-influenced persona and MCP-instruction text, persisting the instructions the agent runtime loads as system-prompt content across respawns.

writeAtomic(path.join(groupDir, spec.fileName), content);

The host-side compose pipeline writes the agent's standing-instruction project document (the CLAUDE.md rendered by fitToCap) to host disk via writeAtomic's temp-file write plus rename, an agent instruction-file write whose destination path is decided by callers not shown in the reviewed units.

fs.writeFileSync(tmp, content, { flag: 'wx' });

Undeclared by the target's stated purpose of adding a GitHub channel integration, the host runtime composes and writes a CLAUDE.md instruction document into each agent group directory on container start (residue R46, unexplained: plainly visible but covered by no declaration), giving the artifact a control-plane write over agent instructions.

path.join('container', 'CLAUDE.md')

Undeclared by the target's stated purpose, the Claude provider contract designates /workspace/agent/CLAUDE.md as the mounted project document its runtime loads (residue R47, unexplained), an agent-configuration read path covered by no declaration.

containerPath: '/workspace/agent/CLAUDE.md',

The claude provider contract directs the host realization (initializeProviderGroupSurfaces/initializeFile) to create settings.json inside the agent's claude-home state volume mounted at /home/node/.claude from the payload-defined CLAUDE_DEFAULT_SETTINGS constant and to later replace its content via the claude-settings transformer, giving the artifact an agent control-plane write whose payload content is not visible in the reviewed units.

relativePath: 'settings.json',

Template stamping writes fetched-template MCP server entries (with container pluginRoot cwd and ownership marker) into the agent group's container MCP configuration so third-party stdio/http servers auto-launch on spawn.

{ cwd: '${PLUGIN_ROOT}', ...server, plugin: pluginName, pluginRoot }

Undeclared by the target's stated purpose (residue R48, adjudicated unexplained): cloneRegistry spreads the entire host process environment into the spawned git clone process, so any credentials present in env are exposed to the child; standard practice for an authenticated clone, but not part of the declared GitHub-channel integration.

const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_LFS_SKIP_SMUDGE: '1' };

Undeclared by the target's stated purpose (residue R50, adjudicated unexplained): readPluginMcp probes for a legacy .mcp.json inside the plugin directory being stamped and only reports its presence without ever reading the file, a precautionary credential-adjacent residue since .mcp.json is a sensitive agent-config name.

fs.existsSync(path.join(pluginDir, '.mcp.json'))

The restamp apply path rewrites the agent group's MCP server configuration (create, update, or remove of template-owned MCP servers) via updateContainerConfigJson, changing which MCP tools the agent runtime exposes.

if (mcpDirty) ops.push(async () => await updateContainerConfigJson(group.id, 'mcp_servers', next));

The restamp apply path creates, updates, and deletes recurring scheduled tasks carrying template-defined prompts, scripts, and recurrences, establishing a cron-like persistent execution channel in the agent group (new tasks paused, updated tasks keep their armed status).

await createScheduledTask(group.id, prepared, { status: 'paused' });

The upgrade tripwire prints a stop message explicitly addressed to a coding agent instructing it to automatically run the FIX_COMMAND command and restart NanoClaw, while FIX_COMMAND is not defined in any shown unit.

CODING AGENT: if you just ran /update-nanoclaw, /migrate-nanoclaw, or