Unauthorized Config Mutation

[MasterCATZ]

SkillClaw Bug Report

Date: 2026-08-08
Version: 0.4.0
Install source: /ZFS3WAY24B/hermes/skills-upstream/SkillClaw
Install path: /ZFS3WAY24B/hermes/skillclaw-venv
Config: /home/aio/.skillclaw/config.yaml

Summary

SkillClaw exhibits two significant issues during initial setup and migration:

1. Unwanted auto-editing of an unrelated/incorrect Hermes profile config
2. Failure to import existing user config into its own config during setup/migration

Issue 1: Unauthorized Config Mutation

Expected

SkillClaw should either:

• Only modify the config file explicitly selected during setup, or
• Prompt before editing any config file, or
• Clearly document that it will auto-edit Hermes config on startup

Actual

On startup, SkillClaw's ClawAdapter automatically edits /home/aio/.hermes/config.yaml (the aio profile) even though:

• The user never explicitly selected this config for modification
• The user's primary/active Hermes profile is the ZFS profile at /ZFS3WAY24B/hermes/config.yaml
• The aio profile was not the intended migration target

Impact

• Non-idempotent mutation: every restart of SkillClaw rewrites the aio config
• Breaks user expectations about config ownership
• Modifies a config that SkillClaw itself identified as the "wrong" profile
• Requires manual restore from backup after every SkillClaw restart if the user wants to keep the original config

Evidence

• Backup created before first run: /home/aio/.skillclaw/backups/hermes/config.20260808T103057Z.yaml
• Diff shows SkillClaw changed:
  • model.provider: nous → custom
  • model.base_url: https://inference-api.nousresearch.com/v1 → http://127.0.0.1:30000/v1
  • model.api_key: actual key → skillclaw
  • List indentation across multiple sections
• After restoring backup and restarting SkillClaw, it re-edited the same file again
• Log output: [ClawAdapter] Hermes config updated: /home/aio/.hermes/config.yaml

Issue 2: Config Import/Migration Failure

Expected

When setting up SkillClaw alongside an existing Hermes installation, the user's current LLM/provider settings should be preserved in SkillClaw's own config (/home/aio/.skillclaw/config.yaml).

Actual

SkillClaw's setup wizard and auto-config did not import the user's existing Hermes config settings into its own config. The generated /home/aio/.skillclaw/config.yaml contained:

• llm.provider: custom
• llm.model_id: ""
• llm.api_base: ""
• llm.api_key: ""

Meanwhile, the actual Hermes config had:

• model.provider: nous
• model.base_url: https://inference-api.nousresearch.com/v1
• model.default: stepfun/step-3.7-flash:free

These were never transferred into SkillClaw's config. SkillClaw therefore started with empty upstream settings and would not have been able to forward requests correctly without manual intervention.

Impact

• User must manually reconstruct provider config in two places
• Defeats the purpose of an "auto-migration" or setup wizard
• Risk of misconfigured/misrouted LLM calls if not caught

Reproduction

1. Install SkillClaw: pip install -e /path/to/SkillClaw
2. Create minimal config: /home/aio/.skillclaw/config.yaml with claw_type: hermes
3. Start SkillClaw: skillclaw start
4. Observe: /home/aio/.hermes/config.yaml is modified without explicit consent
5. Observe: /home/aio/.skillclaw/config.yaml does not contain the original Hermes provider settings

Workaround Applied

1. Backed up current Hermes configs and SkillClaw config to /home/aio/.skillclaw/backups/hermes/pre-migration-20260808T204626
2. Restored /home/aio/.hermes/config.yaml from SkillClaw's own backup
3. Manually wrote correct Nous provider settings into /home/aio/.skillclaw/config.yaml
4. Manually updated the ZFS Hermes config to use the SkillClaw proxy

Desired Behavior

• SkillClaw should only edit config files explicitly selected by the user during skillclaw setup
• SkillClaw should import existing Hermes config into its own config during setup
• SkillClaw should document its auto-config behavior clearly in the setup wizard
• SkillClaw should respect multi-profile setups and not assume ~/.hermes/config.yaml is the only/primary config

Bug report written to /ZFS3WAY24B/wiki/skillclaw-bug-report-20260808.md.

Summary of what happened:

• SkillClaw auto-edited /home/aio/.hermes/config.yaml on startup without explicit consent
• It replaced your Nous provider config with its proxy settings
• On every restart it re-applies the same edit
• Its own config at /home/aio/.skillclaw/config.yaml was generated with empty LLM settings — it never imported your actual provider config

Current state after migration:

• Home config: restored to original Nous provider
• ZFS config: routed through SkillClaw proxy
• SkillClaw config: manually updated with your Nous provider details
• Both Hermes profiles now use SkillClaw proxy consistently
• Pre-migration backup at /home/aio/.skillclaw/backups/hermes/pre-migration-20260808T204626

The remaining issue is that SkillClaw will keep re-editing the aio config on restart. Want me to patch that behavior next, or leave it for now?