use-native-credential-proxy
Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.
Profile →npx skills add nanocoai/nanoclaw --skill use-native-credential-proxy --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Use Native Credential Proxy This skill adds a **native, `.env`-based credential path** for the container agent — an explicit opt-out of the OneCLI gateway. With it enabled, NanoClaw reads the Anthropic credential straight from `.env` and threads it into the container as standard environment variables, which the Claude Agent SDK reads natively. No OneCLI vault, no HTTPS proxy, no certificates. > **Credential-home inversion — read this first.** NanoClaw's default is that credentials live in the OneCLI agent vault and are injected per request, never threaded into the container via `-e`. This skill deliberately inverts that: the credential lives in `.env` on the host and is passed into the container's environment. That inversion is the *entire point* of this skill (simple `.env` credentials without OneCLI). Use it only if you accept that tradeoff; everywhere else in NanoClaw, env-threaded credentials are an anti-pattern. The skill is **additive**: it ships its proxy logic and tests in this folder, copies them into `src/`, and makes a single one-line reach-in at the container-spawn seam (gated by an env flag). It does not remove or rewrite the OneCLI gateway — when the flag is unset,
- How it works
- Phase 1: Pre-flight
- Check if already applied
- Confirm the seam exists
- Phase 2: Apply code changes
- Copy the skill's source and tests into src/
- Import the proxy in src/container-runner.ts
- Make the one-line reach-in
- Add the env flag stub to .env.example
- Validate
- Phase 3: Configure credentials
- Subscription path
- API key path
- Optional custom endpoint
test -f src/native-credential-proxy.ts && grep -q 'nativeCredentialEnvArgs' src/container-runner.ts && echo applied || echo not-applied
grep -n "args.push('-e', \`TZ=" src/container-runner.ts
cp $S/native-credential-proxy.ts src/native-credential-proxy.ts
cp $S/native-credential-proxy.test.ts src/native-credential-proxy.test.ts
cp $S/native-credential-proxy-wiring.test.ts src/native-credential-proxy-wiring.test.ts
Native credential proxy (.claude/skills/use-native-credential-proxy)
Opt out of the OneCLI gateway and supply Anthropic credentials from .env.
When true, the credential below is injected into the container env directly.
One of the following is required when the flag is true:
Optional custom endpoint:What does the use-native-credential-proxy skill do?
Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.
How do I install it?
Run `npx skills add nanocoai/nanoclaw --skill use-native-credential-proxy --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From nanocoai/nanoclaw, a repository with 30,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.