Borrowing it
Nothing to install: this file belongs to sskarz/nanoclawbster. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sskarz/nanoclawbster/main/.claude/skills/setup/SKILL.mdgit clone --depth 1 https://github.com/sskarz/nanoclawbsterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sskarz/nanoclawbster/setup)<a href="https://agentmods.dev/skills/sskarz/nanoclawbster/setup"><img src="https://agentmods.dev/badge/skills/sskarz/nanoclawbster/setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02598 |
| Opus 5 | $0.00028 | $0.01299 |
| Sonnet 5 | $0.00011 | $0.00520 |
| Haiku 4.5 | $0.00006 | $0.00260 |
Grade D, and why
setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Linux: `curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs`, or nvm Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Linux: install with `curl -fsSL https://get.docker.com | sh && sudo usermod -aG docker $USER`. Note: user may need to log out/in for group membership. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Linux: `curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs`, or nvm This is a copy
88% identical to setup — 110 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 181 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NanoClawbster Setup
Primary Path: bash setup.sh
For new installations, the recommended approach is a single command:
bash setup.sh
This runs the bootstrap (Node.js + npm install) then automatically launches an interactive wizard that handles:
- Docker — detects, installs, or starts Docker
- Credentials — prompts for Discord bot token, Claude auth (API key or OAuth), and assistant name
- Container image — builds the agent container with streamed output
- Admin channel — auto-detects the bot owner via Discord API, creates a DM channel, and registers it as the admin group
- Service — builds TypeScript and installs/starts the system service (systemd on Linux, launchd on macOS, nohup fallback for WSL)
- Verification — confirms everything is running and prints a summary
The wizard detects existing state (.env, registered groups, running service) at each step and offers to skip or reconfigure.
Secondary Path: Claude Code Skill
For power users or troubleshooting individual steps, use npx tsx setup/index.ts --step <name> with the steps below. Steps emit structured status blocks to stdout. Verbose logs go to logs/setup.log.
Principle: When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. pasting a secret token). If a dependency is missing, install it. If a service won't start, diagnose and repair. Ask the user for permission when needed, then do the work.
UX Note: Use AskUserQuestion for all user-facing questions.
1. Bootstrap (Node.js + Dependencies)
Run bash setup.sh and parse the status block.
- If NODE_OK=false → Node.js is missing or too old. Use
AskUserQuestion: Would you like me to install Node.js 22?If confirmed:- macOS:
brew install node@22(if brew available) or install nvm thennvm install 22 - Linux:
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs, or nvm - After installing Node, re-run
bash setup.sh
- macOS:
- If DEPS_OK=false → Read
logs/setup.log. Try: deletenode_modulesandpackage-lock.json, re-runbash setup.sh. If native module build fails, install build tools (xcode-select --installon macOS,build-essentialon Linux), then retry. - If NATIVE_OK=false → better-sqlite3 failed to load. Install build tools and re-run.
- Record PLATFORM and IS_WSL for later steps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 181 lines · 55 tokens per session scan D 846be719c9c1
setup is a skill published in the GitHub repository sskarz/nanoclawbster (2 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 2,598 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). It is 88% identical to setup, differing in 110 lines, and is treated as a copy.
Other skills, from other repositories
host-ssh
Run PowerShell on a GuideAnts SSH machine (Windows OpenSSH) via the machine registry in the guide Environment. Use when the user needs host OS tasks — drives, dotnet, Playwright, processes — not file I/O on paths already visible in the workspace file list.
html-craft
Create and verify single-file interactive HTML pages in the sandbox: build or edit the file, then prove the result with headless-Chromium screenshots, in-page DOM/geometry assertions, and JS-error capture (Playwright). No GPU, no service, no network. Use when the user wants an HTML page, animation, demo, dashboard, or…
mssql-query
Query the stack's SQL Server (mssql-express) from the sandbox: probe, databases, tables, schema, sample rows, read-only SQL, and opt-in DML/DDL. Connection string comes from GADBCONNECTIONSTRING in the Guide's Environment variables. Use when the user wants to inspect or query the GuideAnts database.
audiocpp-asr-extended
Transcription beyond the GuideAnts wrapper contract: transcribe workspace files by path (no upload, no 50 MB gateway cap), pass language hints, and sideload other qwen3-family ASR snapshots from Hugging Face through the wrapper. Use when a transcription needs a language hint, the file is large, or the user wants to…
audiocpp-diarize
Speaker diarization: figure out who spoke when in a recording and produce a speaker-labeled transcript, by spawning a private audio.cpp engine with the sortformer diarization model and labeling each turn with the local ASR engine. Use when the user asks to diarize a meeting or call recording, separate or identify…
audiocpp-tts-controls
Advanced synthesis controls on the loaded audio.cpp TTS model: deterministic output via seed, forcing the spoken language, voice-design from a text description (instructions), and enumerating builtin speaker ids — none of which the built-in GuideAnts audio tools expose. Use when the user wants reproducible audio, a…