The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ssh, git, and subprocess.run to manage remote virtual machines and execute testing scripts. This is the primary function of the skill.
Evidence in scripts/exe-run.sh and scripts/e2e-evidence.py shows these commands are scoped to the exe.dev provider and the user's own repositories.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs standard development dependencies including Node.js (from NodeSource), Docker (from get.docker.com), and pnpm.
These downloads target well-known, trusted package registries and official installation scripts.
[CREDENTIALS_SAFE]: The skill implements strict security measures for handling Anthropic API keys and OAuth tokens.
Credentials are read from local files (defaulting to ~/.nanoclaw-e2e/), uploaded to the VM via SSH stdin to avoid command-line exposure, and stored on the guest with 0600 permissions.
The e2e-evidence.py script performs mandatory redaction of secrets, tokens, and passwords from logs before they are bundled for export, using regex patterns like sk-(?:ant-|proj-|svcacct-)?[A-Za-z0-9_-]{16,}.
[PRIVILEGE_ESCALATION]: The skill uses sudo and chmod for environment setup (e.g., installing Docker, setting file permissions).
These are standard administrative actions for software installation and security hardening (e.g., chmod 600 for keys).
[ADVERSARIAL_ROBUSTNESS]: The skill includes identity validation for repositories and commits to ensure the tested code matches the expected source.
scripts/e2e-evidence.py verifies that only NanoClaw setup commits exist between the tested SHA and the current HEAD before allowing evidence export.

e2e-exe-dev