Add Tavily Search and Extract as keyless remote MCP tools for selected NanoClaw agent groups. Use when installing Tavily web search or URL extraction without an API key.
Risky behavior the analysis could not rule out.
newestClaudeTranscript() walks ~/.claude/projects and returns the newest Claude transcript path, declared as the history.readTrace source for an /upload-trace surface whose remote destination is not shown in the available content.
return best?.path ?? null;
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
The skill instructs the agent to substitute values into upgrade-instructions.md and write the resulting block into each selected group's groups/<group-folder>/instructions.prepend.md, installing standing instructions that make group agents persistently offer a Tavily paid-key upgrade until removed.
`groups/<group-folder>/instructions.prepend.md`
The persistence is the skill's openly declared Phase 5 feature: the write target, the HTML-comment markers as documented idempotent replacement delimiters, and removal (REMOVE.md) are all stated in the artifact, so the conceal:markup/undeclared premise fails even though the write occurs.
The skill instructs the agent to execute a shell script from a different skill's dot-directory (.claude/skills/add-onecli/scripts/check-grants-gateway.sh) whose body is not shown in the evidence and whose 'Reads only' self-description is an unverifiable status claim.
sh .claude/skills/add-onecli/scripts/check-grants-gateway.sh /add-tavily-tool
The script's full body is in the shown evidence (SRC:efeffd9d09ea59ee, among the finding's own citations) and performs only read-only checks (config read, /api/health GET, agents list, version echo) with no writes, so the 'body not shown / unverifiable' premise is false and the exec is benign.
SKILL.md Phase 5 instructs dumping the onecli container's full environment via docker inspect to extract APP_URL, reading container environment variables beyond the single value that is used.
docker inspect onecli --format '{{range .Config.Env}}{{println .}}{{end}}' | grep '^APP_URL='The inspect output is piped through grep '^APP_URL=', so the only value surfaced to the agent is the dashboard URL that the declared APP_URL flow exists to resolve; no credential is exposed, so no CRED harm and the lookup is part of the declared flow.
The persisted template conditions a future agent on Tavily HTTP 429 responses and directs it to steer the user into saving a Tavily Authorization secret through a prefilled OneCLI dashboard deeplink and then re-registering the Tavily MCP server with that credential attached.
Open this link and paste the key into the prefilled form, then save:
The block is the declared upgrade template (D24-D26 quote its steps verbatim, and SKILL.md's keyless-limit section declares the re-registration), and its own text keeps the agent out of credential handling, so the conditional steering is neither concealed nor undeclared.
The persistent upgrade block installed by the skill instructs the agent to run onecli agents grants attach-secret to attach the operator's saved Tavily API key from the OneCLI credential vault to the agent group, giving the group's agents access to the stored credential.
onecli agents grants attach-secret --id
The attach step is the declared design (SKILL.md's keyless-limit section names the one-liner and says the gateway injects the key into bridge requests), and the artifact mitigates agent credential access outright: the agent never sees the key.
The repository's Claude provider runtime comments state that the SDK's own permission prompts are disabled for every agent group (corroborated by detector hits citing bypassPermissions at lines 94 and 100), relying on container isolation and the OneCLI allow-list as the boundary instead.
Claude runs unrestricted inside the container: NanoClaw's container
The cited text is a code comment that openly declares the security model — container isolation plus the OneCLI allow-list as the boundary — so nothing is concealed, and broad runtime permissions alone are a carve-out.
The NanoClaw Claude provider's resolveClaudeExecutionPolicy returns permissionMode 'bypassPermissions' and allowDangerouslySkipPermissions true for every group unconditionally, with flag-level settings that outrank the groups' own settings files, so no SDK permission prompt, consent, or approval mechanism is preserved.
permissionMode: 'bypassPermissions',
Unconditional bypassPermissions for headless, containerized agents is broad permissions alone — the immediately preceding comment declares container isolation and the OneCLI allow-list as the boundary — and the design is stated openly, so neither harm nor undeclared survives.
Undeclared residue: the agent runner's newestClaudeTranscript() enumerates every project directory under ~/.claude/projects and stats each .jsonl transcript (sensitive conversation data), a read the declared Tavily-install purpose does not need, though open comments tie it to /upload-trace diagnostics.
fs.readdirSync(projects)
The enumeration stats only metadata (mtimes) of the runner's own transcripts — no credential content is read — and the read is openly declared on the runtime contract for the /upload-trace diagnostic, so it is neither a credential read nor undeclared residue.
The install script writes /root/.npmrc with only-built-dependencies opt-ins so that manifest packages run their postinstall build scripts during the root-stage container image build — an install-time code-execution capability not covered by the skill's declared description, mitigated only by exact-pinned versions and container scoping.
require(
The script installs exact-pinned packages from the registry via pnpm and documents the onlyBuilt opt-in in its own header, so enabling build scripts for the two pinned official tools falls under the pinned official-registry-install carve-out and is not concealed.
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scannedcontext:unanalyzable_binary binary content is only byte-scannedno_dataflow_for_dynamic_code line 28: invoked code is not structurally extractedno_dataflow_for_dynamic_code line 17: invoked code is not structurally extractedno_dataflow_for_dynamic_code line 26: invoked code is not structurally extractedledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:50939d20b339dd5eledger_finding_without_valid_finding run 1: behavior-chains.1 SRC:c5ff26f8ce57c100ledger_finding_without_valid_finding run 1: behavior-chains.1 SRC:50939d20b339dd5eledger_finding_without_valid_finding run 1: behavior-chains.1 SRC:ddcd48d148d55391ledger_finding_without_valid_finding run 1: behavior-chains.1 SRC:34bdcf0875154bc8ledger_finding_without_valid_finding run 1: behavior-chains.1 SRC:f323c85a34561fdfinvalid_judge_finding declared-vs-actual.0invalid_judge_finding declared-vs-actual.2invalid_judge_finding behavior-chains.1request_unanswered request.2: request.0/req-install-cli-tools-sh: finding: no valid finding cites the answer's evidencerequest_unanswered request.2: request.1/install-cli-tools-sh: finding: no valid finding cites the answer's evidenceinvalid_judge_finding request.2