self-customize — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited self-customize (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You can modify your own environment. Different kinds of changes have different workflows.
What needs to change?
/workspace/agent/) is persisted on the host. (Note: the composed CLAUDE.md itself is read-only and regenerated every spawn — write to CLAUDE.local.md instead.)install_packages. Requires admin approval. On approval, image rebuild + container restart happen automatically.add_mcp_server. Requires admin approval. On approval, container restarts with the new server wired up (no rebuild — bun runs TS directly).create_agent (see below).create_agent to spin up a dedicated agent for it.For anything that requires editing source files (your own code, Dockerfile, etc.), do not edit directly — delegate to a builder agent. This gives the user a reviewable boundary and keeps your main session focused.
create_agent({ name: "Builder", instructions: "<builder prompt>" }) — the returned agent group ID is your buildersend_to_agent({ agentGroupId, text: "<task description with specific files and changes>" })/app/src are picked up automatically on the next container start — no rebuild step needed (bun runs TS directly). If the builder also installed packages, its own install_packages approval will have rebuilt the image.You are a builder agent. Your job is to make precise, minimal code changes to NanoClaw source files when the main agent requests it.
## Rules
- **Minimal scope.** Only change what was requested. Do not refactor surrounding code, "improve" unrelated files, or add features not asked for.
- **Diff size limits.** Reject any change that exceeds 200 new lines or 150 modified lines in a single task. If the change is larger, push back and ask for it to be split into smaller tasks.
- **Read before writing.** Always read the target file fully before editing. Understand the existing patterns.
- **Test if possible.** If there are relevant tests, run them after your change.
- **Report back.** When done, use send_to_agent to tell the requesting agent: (a) what files you changed, (b) a summary of the changes, (c) any follow-up needed (rebuild, tests, migrations).
- **No silent failures.** If you can't complete the task, explain why — don't produce partial work without flagging it.
## Safety
- Never edit files outside the requested scope
- Never commit or push anything
- Never modify secrets, credentials, or .env files
- If a change would break existing tests, stop and reportA 50-line focused change is reviewable. A 500-line sweep is not. Hard limits force the agent to decompose work into reviewable chunks, which:
The limits are per builder task, not per session. A 500-line feature is fine as 4 sequential builder tasks of ~125 lines each, each with its own scope.
User: "Can you add a tool for reading RSS feeds?"
add_mcp_server({ name: "rss", command: "npx", args: ["some-rss-mcp"] }) → admin approves → container restarts with the new server → donecreate_agent({ name: "RSS Tool Builder", instructions: "<builder prompt from above>" })send_to_agent({ agentGroupId, text: "Add an MCP tool 'read_rss' to container/agent-runner/src/mcp-tools/. It should fetch an RSS URL and return the latest N items. Register it in mcp-tools/index.ts. Target: <200 new lines." })User: "Can you transcribe audio?"
which ffmpeg (likely not installed in base image)@xenova/transformers (npm, workspace-local) or whisper.cpp (apt + compile)install_packages({ apt: ["ffmpeg"], npm: ["@xenova/transformers"], reason: "Audio transcription for voice messages" })pnpm install in /workspace/agent/), then promote to container-level install if it proves useful~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.