I am little bit confused about the API of tweetnacl. Does the function nacl.box.keyPair.fromSecretKey except the secretKey argument to be already clamped? Or it is it fine to provide a random byte string? The way I read the code, tweetnacl does the clamping later on, correct? So is the secretKey in tweetNacl always a random byte string and the clamping is done in internal library functions?
Correct, you don't need to be concerned with 25519 clamping.
The library handles this. You simply need to supply a uniformly random 256-bit string.