update-nanoclaw — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited update-nanoclaw (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Your NanoClaw fork drifts from upstream as you customize it. This skill pulls upstream changes into your install without losing your modifications.
Run /update-nanoclaw in Claude Code.
Preflight: checks for clean working tree (git status --porcelain). If upstream remote is missing, asks you for the URL (defaults to https://github.com/nanocoai/nanoclaw.git) and adds it. Detects the upstream branch name (main or master).
Backup: creates a timestamped backup branch and tag (backup/pre-update-<hash>-<timestamp>, pre-update-<hash>-<timestamp>) before touching anything. Safe to run multiple times.
Preview: runs git log and git diff against the merge base to show upstream changes since your last sync. Groups changed files into categories:
.claude/skills/): unlikely to conflict unless you edited an upstream skillsrc/): may conflict if you modified the same filescontainer/): triggers container rebuildpackage.json, pnpm-lock.yaml, tsconfig*.json): lockfile changes trigger dep installUpdate paths (you pick one):
merge (default): git merge upstream/<branch>. Resolves all conflicts in one pass.cherry-pick: git cherry-pick <hashes>. Pull in only the commits you want.rebase: git rebase upstream/<branch>. Linear history, but conflicts resolve per-commit.abort: just view the changelog, change nothing.Conflict preview: before merging, runs a dry-run (git merge --no-commit --no-ff) to show which files would conflict. You can still abort at this point.
Conflict resolution: opens only conflicted files, resolves the conflict markers, keeps your local customizations intact.
Validation: runs pnpm run build and pnpm test. If container files changed, also runs the container typecheck and ./container/build.sh.
Breaking changes check: after validation, reads CHANGELOG.md for any [BREAKING] entries introduced by the update. If found, shows each breaking change and offers to run the recommended skill to migrate.
The backup tag is printed at the end of each run:
git reset --hard pre-update-<hash>-<timestamp>Backup branch backup/pre-update-<hash>-<timestamp> also exists.
Only opens files with actual conflicts. Uses git log, git diff, and git status for everything else. Does not scan or refactor unrelated code.
Help a user with a customized NanoClaw install safely incorporate upstream changes without a fresh reinstall and without blowing tokens.
git status, git log, git diff, and open only conflicted files.The update process itself evolves, so run its newest version before doing anything else:
upstream remote exists (default https://github.com/nanocoai/nanoclaw.git) and fetch: git fetch upstream --prune. Detect the upstream branch (main or master).git checkout upstream/<branch> -- .claude/skills/update-nanoclaw/.claude/skills/update-nanoclaw/SKILL.md. If it changed, follow the updated version from the top instead of this one.This is the only working-tree change expected before the preflight check; the full update commits it along with everything else.
Run:
git status --porcelainIf output is non-empty:
.claude/skills/update-nanoclaw/ are the Step 0a self-refresh — ignore those and proceed.Confirm remotes:
git remote -vIf upstream is missing:
https://github.com/nanocoai/nanoclaw.git).git remote add upstream <user-provided-url>git fetch upstream --pruneDetermine the upstream branch name:
git branch -r | grep upstream/upstream/main exists, use main.upstream/master exists, use master.upstream/main should use upstream/$UPSTREAM_BRANCH instead.Fetch:
git fetch upstream --pruneCapture current state:
HASH=$(git rev-parse --short HEAD)TIMESTAMP=$(date +%Y%m%d-%H%M%S)Create backup branch and tag (using timestamp to avoid collisions on retry):
git branch backup/pre-update-$HASH-$TIMESTAMPgit tag pre-update-$HASH-$TIMESTAMPSave the tag name for later reference in the summary and rollback instructions.
Compute common base:
BASE=$(git merge-base HEAD upstream/$UPSTREAM_BRANCH)Show upstream commits since BASE:
git log --oneline $BASE..upstream/$UPSTREAM_BRANCHShow local commits since BASE (custom drift):
git log --oneline $BASE..HEADShow file-level impact from upstream:
git diff --name-only $BASE..upstream/$UPSTREAM_BRANCHBucket the upstream changed files:
.claude/skills/): unlikely to conflict unless the user edited an upstream skillsrc/): may conflict if user modified the same filescontainer/): triggers container rebuild (+ typecheck if agent-runner/src/ changed)package.json, pnpm-lock.yaml, tsconfig*.json): lockfile changes trigger dep installversions.json): a changed onecli-gateway / onecli-cli value requires upgrading the OneCLI gateway/CLI to match — see Step 5.5Large drift check: If the upstream commit count and age suggest the user has a lot of catching up to do, mention that /migrate-nanoclaw might be a better fit — it extracts customizations and reapplies them on clean upstream instead of merging. Offer it as an option but don't push.
Present these buckets to the user and ask them to choose one path using AskUserQuestion:
If Abort: stop here.
If Full update or Rebase:
git merge --no-commit --no-ff upstream/$UPSTREAM_BRANCH; git diff --name-only --diff-filter=U; git merge --abortRun:
git merge upstream/$UPSTREAM_BRANCH --no-editIf conflicts occur:
git status and identify conflicted files.git add <file>git commit --no-editIf user chose Selective:
BASE=$(git merge-base HEAD upstream/$UPSTREAM_BRANCH)git log --oneline $BASE..upstream/$UPSTREAM_BRANCHgit cherry-pick <hash1> <hash2> ...If conflicts during cherry-pick:
git add <file>git cherry-pick --continueIf user wants to stop:
git cherry-pick --abortRun:
git rebase upstream/$UPSTREAM_BRANCHIf conflicts:
git add <file>git rebase --continueIf it gets messy (more than 3 rounds of conflicts):
git rebase --abortCheck if the merge changed any lockfiles or package manifests:
git diff <backup-tag-from-step-1>..HEAD --name-only | grep -E '^(pnpm-lock\.yaml|package\.json)$'pnpm installgit diff <backup-tag-from-step-1>..HEAD --name-only | grep -E '^container/agent-runner/(bun\.lock|package\.json)$'command -v bun succeeds: cd container/agent-runner && bun install./container/build.shSkip this step if neither lockfile changed.
Check which areas changed to determine what to validate:
CHANGED_FILES=$(git diff --name-only <backup-tag-from-step-1>..HEAD)Host build (always):
pnpm run buildpnpm test (do not fail the flow if tests are not configured)Container typecheck (only if container/agent-runner/src/ files are in CHANGED_FILES AND bun types are available):
pnpm exec tsc -p container/agent-runner/tsconfig.json --noEmitCannot find type definition file for 'bun'), skip with a note — type errors will surface at container runtime insteadContainer image rebuild (only if any container/ files are in CHANGED_FILES):
./container/build.shIf build fails:
The OneCLI gateway and CLI are external components pinned in versions.json; when a pin moves, the running version must be upgraded to match or the new code may fail against it.
If git diff <backup-tag-from-step-1>..HEAD -- versions.json shows the onecli-gateway or onecli-cli value changed, follow docs/onecli-upgrades.md before the service restart (Step 8). Otherwise skip.
After validation succeeds, check if the update introduced any breaking changes.
Determine which CHANGELOG entries are new by diffing against the backup tag:
git diff <backup-tag-from-step-1>..HEAD -- CHANGELOG.mdParse the diff output for lines that contain [BREAKING] anywhere in the line. Each such line is one breaking change entry. The format is:
[BREAKING] <description>. Run `/<skill-name>` to <action>.If no [BREAKING] lines are found:
If one or more [BREAKING] lines are found:
/<skill-name> part).multiSelect: true so the user can pick multiple skills if there are several breaking changes.Check if skills are distributed as branches in this repo:
git branch -r --list 'upstream/skill/*'If any upstream/skill/* branches exist:
/update-skills using the Skill tool.Detect installed channels by reading src/channels/index.ts and collecting all import './<name>.js'; lines (excluding cli). For providers, check src/providers/index.ts the same way.
If any channels/providers are installed AND upstream/channels or upstream/providers branches exist:
/add-<name> is safe — it only updates code files, credentials and wiring are untouched."multiSelect: true/add-<channel> or /add-<provider> skill.If no channels/providers are installed, skip silently.
Proceed to Step 7.9.
After validation has succeeded, record that this install reached the new version through the supported path. Without this, the startup tripwire stops the host on its next start.
pnpm exec tsx scripts/upgrade-state.ts set "" update-nanoclawpackage.json version.If validation did NOT succeed, do not stamp — leave the tripwire to catch the broken state.
Proceed to Step 8.
Show:
git rev-parse --short HEADgit rev-parse --short upstream/$UPSTREAM_BRANCHgit diff --name-only upstream/$UPSTREAM_BRANCH..HEADTell the user:
git reset --hard <backup-tag-from-step-1>backup/pre-update-<HASH>-<TIMESTAMP>setup/lib/install-slug.sh. Run from your NanoClaw project root:source setup/lib/install-slug.sh && launchctl kickstart -k gui/$(id -u)/$(launchd_label)source setup/lib/install-slug.sh && systemctl --user restart $(systemd_unit) (or, if you want to confirm the unit name first: systemctl --user list-units --type=service | grep "$(. setup/lib/install-slug.sh && systemd_unit)")pnpm run dev.claude/skills/update-nanoclaw/diagnostics.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.