Claude Skill MartBrowse skillsWhat is a Skill?
 
← Back to list

Initialize OneCLI Agent Vault

Installs OneCLI for a NanoClaw project and migrates `.env` API keys into the Agent Vault so agents never see raw credentials.

Security & ReviewAdvanced★ 30,471⑂ 12,865AI score 7/10Last updated: Aug 9, 2026

What it does

End-to-end installer and configurator for the OneCLI gateway (Agent Vault) inside a NanoClaw project.

  • Pre-flight checks: detects an existing working OneCLI install, warns if you're on the native .env credential proxy, and verifies @onecli-sh/sdk is in package.json (otherwise it tells you to run /update-nanoclaw first).
  • Install & wiring: installs gateway + CLI, fixes ~/.local/bin PATH in .bashrc/.zshrc, sets api-host, appends ONECLI_URL to .env, and polls /health for up to 15 seconds.
  • Credential migration: registers ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, OPENAI_API_KEY, PARALLEL_API_KEY and similar as vault secrets with host patterns, then strips only those lines from .env. Channel tokens (Telegram/Slack/Discord) stay put because the host process needs them.
  • Build, restart, verify: pnpm run build, launchd/systemd restart commands, then log grep for OneCLI gateway config applied.
  • Extras: a canonical safe-merge pattern for agents set-secrets (which replaces, not appends), git-over-HTTPS gotchas (GIT_SSL_CAINFO, Basic vs Bearer for GitHub), and troubleshooting for a down gateway or port 10254 conflicts.

Who it's for

  • NanoClaw operators who want API keys out of container environment variables
  • Security-minded users who want per-agent policies and rate limits at the gateway
  • Anyone hitting the OneCLI breaking change after /update-nanoclaw

Examples

  1. "I just ran /update-nanoclaw and it wants OneCLI — set it up" → pre-flight, install, migrate keys, rebuild and restart the service.
  2. "Move my ANTHROPIC_API_KEY and OPENAI_API_KEY into the vault" → only container-facing keys are migrated; channel tokens remain in .env.
  3. "My agent can't push to GitHub through the proxy" → diagnoses the missing GIT_SSL_CAINFO and the Basic-vs-Bearer auth format difference and supplies the settings block.

· · · Install guide · · ·

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .claude/skills/init-onecli folder from the GitHub repo nanocoai/nanoclaw into my ~/.claude/skills/init-onecli/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/nanocoai/nanoclaw.git /tmp/nanoclaw && mkdir -p ~/.claude/skills && cp -r /tmp/nanoclaw/.claude/skills/init-onecli ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal and create the skills directory: mkdir -p ~/.claude/skills
  2. Clone the repository into a temp folder: git clone https://github.com/nanocoai/nanoclaw.git /tmp/nanoclaw
  3. Copy just this skill: cp -r /tmp/nanoclaw/.claude/skills/init-onecli ~/.claude/skills/
  4. Change into your NanoClaw project root — the skill must run from inside the project.
  5. Back up your environment file first: cp .env .env.bak, because the skill deletes credential lines.
  6. Make sure Docker is running (the gateway is a Docker Compose stack).
  7. Start Claude Code and ask "initialize the OneCLI Agent Vault", or invoke /init-onecli.
  8. Answer the prompts (subscription token vs API key, which credentials to migrate) and review the remote curl … | sh install commands yourself before approving them.
View source on GitHub ↗License: MIT