add-onecli

45 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By nanocoai/nanoclaw (GitHub) · coding · 31,103 stars · scanned at commit df750f6

Install or refresh OneCLI as NanoClaw's gateway provider. Use when setup selects OneCLI, an existing OneCLI-backed install is migrated to the gateway seam, or its runtime, approval bridge, setup, and agent guidance must be restored from the in-tree package.

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: gmail.googleapis.com, api.github.com, api.stripe.com, host.docker.internal, claude.ai

The author does not mention this.

Found in 26 places.

.claude/skills/add-onecli/payload/container/skills/onecli-gateway/SKILL.md, line 36curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=5"
.claude/skills/add-onecli/payload/container/skills/onecli-gateway/SKILL.md, line 37curl -s "https://api.github.com/user/repos?per_page=10"
.claude/skills/add-onecli/payload/container/skills/onecli-gateway/SKILL.md, line 38curl -s "https://api.stripe.com/v1/charges?limit=5"

Show 17 more

.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 20curl -s "$GW/api/health" # liveness check; an old gateway may say "unknown" for `version`
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 21curl -s -o /dev/null -w '%{http_code}' "$GW/v1/health"
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 117curl -s "$GW/v1/health" # must return {"status":"ok",...}; GW from the Detect step
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 124curl -s "$GW/api/health" # its "version" must be the pin
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 133curlimages/curl -s -o /dev/null -w '%{http_code}' http://host.docker.internal:10254/v1/health
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 190curl -fsSL -o /tmp/onecli.tgz \
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 517const res = await gateway.fetch(url, init);
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 535const res = await gateway.fetch(url, init);
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 564const res = await gateway.fetch(url, init);
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 584const res = await gateway.fetch(url, init);
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 601const res = await gateway.fetch(url, init);
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.ts, line 95const response = await fetch(`${base}/v1/secrets`, { headers, signal: AbortSignal.timeout(5_000) });
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.ts, line 130const response = await fetch(healthUrl, { signal: AbortSignal.timeout(5_000) });
.claude/skills/add-onecli/scripts/check-grants-gateway.sh, line 28H=$(curl -fsS --max-time 10 "$U/api/health" 2>/dev/null) || no "could not reach the OneCLI gateway at $U" reach
.claude/skills/add-onecli/scripts/dial-key-check.sh, line 40H=$(curl -fsS --max-time 10 "$GW/api/health") || stop "could not reach the gateway at $GW"
.claude/skills/add-onecli/scripts/install-claude.sh, line 32curl -fsSL https://claude.ai/install.sh | bash
.claude/skills/add-onecli/scripts/post-upgrade-check.sh, line 15V=$(curl -fsS --max-time 10 "$GW/api/health" 2>/dev/null | jq -r '.version // empty' 2>/dev/null) || V=

and 6 more places

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 64 places.

.claude/skills/add-onecli/payload/container/skills/onecli-gateway/SKILL.md, line 36curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=5"
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 91cd ~/.onecli && (umask 077 && F=~/onecli-db-backup-$(date +%Y%m%d-%H%M%S).sql && docker compose exec -T postgres sh -c 'pg_dump -U "$POSTGRES_USER" "$POSTGRES_D
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 176cd ~/.onecli && (F=<backup file from step 2> && [ -s "$F" ] || { echo "Not restored: '$F' is not a backup file" >&2; exit 1; }; docker compose stop onecli && do

Show 17 more

.claude/skills/add-onecli/payload/src/gateway-providers/onecli-files.test.ts, line 1import { execFile } from 'node:child_process';
.claude/skills/add-onecli/payload/src/gateway-providers/onecli-provider-credentials.test.ts, line 1import { spawn } from 'node:child_process';
.claude/skills/add-onecli/scripts/auth.test.ts, line 7vi.mock('node:child_process', () => ({ execFileSync: child.exec, spawnSync: child.spawn }));
.claude/skills/add-onecli/scripts/auth.ts, line 1import { execFileSync, spawnSync } from 'node:child_process';
.claude/skills/add-onecli/scripts/auth.ts, line 35const raw = execFileSync('onecli', ['secrets', 'list', '--max', '0'], {
.claude/skills/add-onecli/scripts/auth.ts, line 97const result = spawnSync('bash', [script, output], { env: childEnv(), stdio: 'inherit' });
.claude/skills/add-onecli/scripts/credential-store.test.ts, line 17vi.mock('node:child_process', () => ({ execFileSync: exec }));
.claude/skills/add-onecli/scripts/credential-store.ts, line 8import { execFileSync } from 'node:child_process';
.claude/skills/add-onecli/scripts/credential-store.ts, line 28execFileSync('onecli', ['secrets', 'list', '--max', '0'], {
.claude/skills/add-onecli/scripts/credential-store.ts, line 47output = execFileSync(
.claude/skills/add-onecli/scripts/remote-proxy.test.ts, line 1import { execFileSync } from 'node:child_process';
.claude/skills/add-onecli/scripts/remote-proxy.test.ts, line 190const out = execFileSync(process.execPath, ['--import', loader, script], { cwd: dir, env, encoding: 'utf8' });
.claude/skills/add-onecli/scripts/secret-input.test.ts, line 1import { spawnSync } from 'node:child_process';
.claude/skills/add-onecli/scripts/secret-input.test.ts, line 2import type { SpawnSyncReturns } from 'node:child_process';
.claude/skills/add-onecli/scripts/secret-input.test.ts, line 10vi.mock('node:child_process', async (importOriginal) => {
.claude/skills/add-onecli/scripts/secret-input.test.ts, line 11const real = await importOriginal<typeof import('node:child_process')>();
.claude/skills/add-onecli/scripts/secret-input.test.ts, line 15signIn.fake ? signIn.fake(args) : real.spawnSync(cmd, args, options)) as typeof real.spawnSync,

and 44 more places

Downloads and installs other software

The author does not mention this.

Found in 4 places.

.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 7**Supported version: exactly the pin (today 1.45.0).** This integration attaches secrets to agents through the agent grants API, which OneCLI added in 1.44; on
.claude/skills/add-onecli/scripts/install-claude.sh, line 32curl -fsSL https://claude.ai/install.sh | bash
.claude/skills/add-onecli/scripts/register-claude-token.sh, line 30echo " curl -fsSL https://claude.ai/install.sh | bash" >&2

Show 1 more

src/container-runner.ts, line 1627dockerfile += `RUN apt-get update && apt-get install -y ${aptPackages.join(' ')} && rm -rf /var/lib/apt/lists/*\n`;

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 4 places.

.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 73cd ~/.onecli && (umask 077 && P=<onecli-gateway pin from .claude/skills/add-onecli/versions.json> && { printf '%s\n' "$P" | grep -Eqx '[0-9]+\.[0-9]+\.[0-9]+' |
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 164cd ~/.onecli && (umask 077 && P=<old-version> && { printf '%s\n' "$P" | grep -Eqx '[0-9]+\.[0-9]+\.[0-9]+|rollback' || { echo "Not saved: '$P' is not a version
.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 239cd ~/.onecli && (umask 077 && L='GATEWAY_BASE_URL=<gateway-host>:<gateway port>' && touch .env && { grep -v '^[[:space:]]*GATEWAY_BASE_URL[[:space:]]*=' .env; e

Show 1 more

.claude/skills/add-onecli/scripts/detect.ts, line 7const env = fs.readFileSync(path.join(root, '.env'), 'utf8');

Changes files outside its own folder

The author does not mention this.

Found in 2 places.

.claude/skills/add-onecli/payload/docs/onecli-upgrades.md, line 193install -m 0755 /tmp/onecli "$(command -v onecli || echo ~/.local/bin/onecli)"
.claude/skills/add-onecli/scripts/setup.ts, line 423HINT: 'CLI binary install failed. Make sure curl is installed and ~/.local/bin is writable.',

Can call paid AI services billed to you

The author does not mention this.

Found in 11 places.

.claude/skills/add-onecli/payload/src/gateway-providers/onecli-chatgpt-stub.test.ts, line 17'https://api.openai.com/auth': {
.claude/skills/add-onecli/payload/src/gateway-providers/onecli-chatgpt-stub.test.ts, line 44expect(claims(out.tokens.id_token)['https://api.openai.com/auth']).toEqual({
.claude/skills/add-onecli/payload/src/gateway-providers/onecli-chatgpt-stub.ts, line 3const AUTH_CLAIMS = 'https://api.openai.com/auth';

Show 8 more

.claude/skills/add-onecli/payload/src/gateway-providers/onecli-provider-credentials.ts, line 138codex: (s) => s.type === 'openai' || ['api.openai.com', 'chatgpt.com'].includes(lower(s.hostPattern)),
.claude/skills/add-onecli/payload/src/gateway-providers/onecli.test.ts, line 730'https://api.openai.com/auth': { chatgpt_account_id: 'onecli-managed' },
.claude/skills/add-onecli/scripts/auth.test.ts, line 235'api.anthropic.com',
.claude/skills/add-onecli/scripts/auth.ts, line 85args.push('--type', 'anthropic', '--host-pattern', 'api.anthropic.com');
.claude/skills/add-onecli/scripts/credential-store.test.ts, line 7api: 'https://api.openai.com',
.claude/skills/add-onecli/scripts/provider-credentials.test.ts, line 21hostPattern: 'generativelanguage.googleapis.com',
.claude/skills/add-onecli/scripts/provider-credentials.test.ts, line 338const key = (host = 'generativelanguage.googleapis.com') =>
src/provider-contracts/claude.ts, line 59modelEndpoints: { api: 'https://api.anthropic.com' },

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'add-onecli' ] || [ -L ~/.agents/skills/'add-onecli' ]; then echo 'A skill folder named add-onecli already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/nanocoai/nanoclaw' "$d" && git -C "$d" checkout --quiet 'df750f67ab4dffbd28a30d30f06560e82a6f450b' -- '.claude/skills/add-onecli' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/add-onecli' ~/.agents/skills/'add-onecli' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'add-onecli' ~/.claude/skills/'add-onecli' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for nanocoai/nanoclaw shows the score of its lowest-scoring skill.

SkillTrust badge for nanocoai/nanoclaw

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/nanocoai/nanoclaw.svg)](https://zalavijaysinh.github.io/skilltrust/repos/nanocoai/nanoclaw/)

Score history

Date	Version	Score
2026-11-11	`df750f6`	45
2026-11-08	`5356b6c`	45
2026-11-07	`5356b6c`	45