NanoClaw is an AI assistant that runs agents inside separate Linux containers, isolating their files and execution environments. People use it to connect agents to messaging services and run assistants with memory and scheduled jobs. The catalogue contains skills and instructions for extending or operating NanoClaw.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/nanocoai/nanoclawnpx agentmods add skills/nanocoai/nanoclaw/add-anydocWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nanocoai/nanoclaw/add-anydoc)<a href="https://agentmods.dev/skills/nanocoai/nanoclaw/add-anydoc"><img src="https://agentmods.dev/badge/skills/nanocoai/nanoclaw/add-anydoc/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nanocoai/nanoclaw/add-anydoc"><img src="https://agentmods.dev/badge/skills/nanocoai/nanoclaw/add-anydoc.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 16 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- medium Agent Snooping · line 41 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 74 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 77 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 78 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium MCP Rug Pull · line 123 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 125 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 126 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01828 |
| Opus 5 | $0.00032 | $0.00914 |
| Sonnet 5 | $0.00013 | $0.00366 |
| Haiku 4.5 | $0.00006 | $0.00183 |
Grade C, and why
add-anydoc scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL "https://registry.npmjs.org/@firecrawl%2Fanydoc" | node -e ' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL "https://registry.npmjs.org/@firecrawl%2Fanydoc" | node -e ' How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add AnyDoc
Install one pinned CLI and one focused container skill. Keep document conversion inside the agent container; do not change NanoClaw's attachment pipeline or add credentials, an MCP server, or a hosted parser.
Preflight
-
Read
CONTRIBUTING.md,docs/skill-guidelines.md, and the supply-chain section ofdocs/SECURITY.md. -
Run this check against the official npm registry before changing files:
curl -fsSL "https://registry.npmjs.org/@firecrawl%2Fanydoc" | node -e ' let body = ""; process.stdin.setEncoding("utf8"); process.stdin.on("data", (chunk) => (body += chunk)); process.stdin.on("end", () => { const metadata = JSON.parse(body); const version = "0.1.6"; const release = metadata.versions?.[version]; const publishedAt = Date.parse(metadata.time?.[version] ?? ""); const eligibleAt = publishedAt + 72 * 60 * 60 * 1000; if (!release) throw new Error(`${version} is missing from the registry`); if (release.deprecated) throw new Error(`${version} is deprecated: ${release.deprecated}`); if (!Number.isFinite(publishedAt)) throw new Error(`missing publish time for ${version}`); if (Date.now() < eligibleAt) throw new Error(`${version} is gated until ${new Date(eligibleAt).toISOString()}`); console.log(`${version} passed the 72-hour release gate`); }); 'Stop on any failure. Do not install a PR commit, add a
minimumReleaseAgeExclude, enable lifecycle scripts, or silently substitute another version, unless the user explicitly approves it. -
Inspect
container/cli-tools.jsonfor@firecrawl/anydocbefore changing files:- No entry: continue.
- Exactly one entry at
0.1.6: leave it unchanged. - A duplicate or any other version: stop and report the conflict.
-
Check whether
container/skills/convert-documents-to-markdown/SKILL.mdandsrc/anydoc-manifest.test.tsalready exist. Reapplying this skill overwrites only those dedicated files. -
If
data/v2.dbexists, inspect per-group image pins before changing files. Standard derived images can be rebuilt from the updated shared image. Stop and report any other pin because its owner must decide how to rebuild it:
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 155 lines · 64 tokens per session scan C 6c641fa15bdc
add-anydoc is a skill published in the GitHub repository nanocoai/nanoclaw (30,727 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 1,828 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ocr-and-documents
Extract text from PDFs and scanned documents. Use webextract for remote URLs, pymupdf for local text-based PDFs, marker-pdf for OCR/scanned docs. For DOCX use python-docx, for PPTX see the powerpoint skill.
apple-notes
Manage Apple Notes via the memo CLI on macOS (create, view, search, edit).
nano-pdf
Edit PDFs with natural-language instructions using the nano-pdf CLI. Modify text, fix typos, update titles, and make content changes to specific pages without manual editing.
okf-frontmatter
Maintain openInvest's docs (docs/wiki chapters + docs/wiki/adr) under Google's Open Knowledge Format (OKF). Two jobs. (1) Teach agents to maintain docs the OKF way — every doc carries a small YAML frontmatter block as the single source of truth (type, title, tags, intent, schemasource, documents); schema details link…
pm-preview
A tool that previews Markdown product documents in a web browser and refreshes the view when the documents change. Markdown is a plain-text format commonly used for project documentation.
Pynchy Development
Use when running pynchy locally — running the app, tests, linting, formatting, prek hooks, or rebuilding the agent container. Also use when determining whether you're on the live Pynchy host or a local machine, and for debugging agent behavior-- session transcript branching, inspecting message history and agent traces…