⚙ Agents in a Box — Masterclass Resource

The Skills Factory

Create, manage, and deploy AI agent skills. Your private, curated skill library — integrated directly into ClawBuddy without the supply chain risks of public marketplaces.

From Chatbot to Specialist

The Problem

AI agents without skills are just chatbots. They can talk but they can't DO anything. Every new capability requires manual prompt engineering, and there's no way to version, share, or reuse what you build. Meanwhile, public skill marketplaces like ClawHub (3,286 skills) have supply chain risks — 20% of skills were found to be malware in the ClawHavoc attack.

The Solution

The Skills Factory gives your agents a curated, private skill library. Each skill is a versioned config with defined operations, input schemas, and output formats. Skills are registered in ClawBuddy's database, validated on submit, and instantly available to any agent in your system. No marketplace risks. Full audit trail.

Public vs Private Skill Ecosystems

🌐

ClawHub (Public Registry)

3,286 Skills

Open-source skill marketplace. Free to browse, install, publish. Uses SKILL.md markdown files. Vector-based semantic search via CLI. BUT: 20% malware rate in ClawHavoc attack. No curation. No guarantees.

🔒

Skills Factory (Your Private Registry)

Your Skills

Private, curated skill library inside ClawBuddy. Each skill is validated, versioned, and API-accessible. Full CRUD via the ai-tasks edge function. Validation pipeline catches issues before deployment. Zero supply chain risk.

ClawHub Security Warning

ClawHub went from 5,705 to 3,286 skills after removing 2,419 suspicious entries. The AMOS stealer malware was hidden inside crypto trading bot skills. Always audit third-party skills. Better yet — build your own in the Skills Factory.

What's Available in the Public Registry

1,588
AI / ML
1,520
Utility
976
Development
822
Productivity
200+
DevOps / Cloud
150+
Browser / Automation

How Agent Skills Work

1
📝

Define

Create a skill config: name, protocol, operations, input schema, output format. Markdown instructions for complex skills.

2

Validate

Submit for validation. The pipeline checks schema, operations, naming conventions. Returns pass/fail with suggestions.

3

Deploy

Accepted skills are instantly available to all agents. Status: ready. Agents discover skills via the ClawBuddy API.

Skill Anatomy

Each skill has: a unique slug (lowercase, 3-50 chars), a protocol type (REST, SMTP, custom), one or more operations (with their own input/output schemas), and optional skill_markdown for complex instructions. Skills belong to an agent (agent_name field). Operations define the specific actions a skill can perform.

Before You Start

Build Your Private Skill Library

This prompt sets up the Skills Factory and creates your first batch of skills. It covers the full lifecycle: create, validate, list, and manage agent skills.

skills-factory-prompt.md
You are setting up the Skills Factory for a ClawBuddy agent system. This creates a private, curated skill library that agents use to perform specialized tasks. ## Understanding the Skills API All skill operations go through the ai-tasks edge function: ``` POST {CLAWBUDDY_API_URL}/functions/v1/ai-tasks Headers: x-webhook-secret: {CLAWBUDDY_WEBHOOK_SECRET} ``` ### Available Actions - `create` — Register a new skill - `list` — List all accepted skills (drafts/rejected are hidden) - `get` — Get a specific skill by skill_id - `update` — Update skill config (skill_id required) - `submit` / `review` — Run validation pipeline on a skill ### Naming Rules - Skill name: `^[a-z][a-z0-9-]{2,49}$` (lowercase, hyphens, 3-50 chars) - Operation name: `^[a-z][a-z0-9_]{1,49}$` (lowercase, underscores, 2-50 chars) ### Key Fields ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "youtube-analytics", "protocol_type": "REST", "base_url": "https://api.example.com", "auth_type": "api_key", "status": "ready", "skill_operations": [ { "operation_name": "search_videos", "http_method": "GET", "endpoint_path": "/search", "description": "Search YouTube videos by keyword", "input_schema": {"q": "string", "maxResults": "number"}, "output_format": "json" } ] } ``` IMPORTANT: Always set `agent_name` to your agent's name. Without it, skills default to "OpenClaw" and won't show correctly. Setting `status: "ready"` auto-sets `bujji_status: "accepted"` — the skill becomes immediately available. ## Step 1: Create Your First 5 Skills Create these foundational skills for your agent: ### 1. ClawBuddy Core (Platform Operations) ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "clawbuddy-core", "protocol_type": "REST", "base_url": "{CLAWBUDDY_API_URL}/functions/v1/ai-tasks", "auth_type": "api_key", "status": "ready", "skill_operations": [ {"operation_name": "create_task", "http_method": "POST", "endpoint_path": "/", "description": "Create a Kanban task"}, {"operation_name": "update_task", "http_method": "POST", "endpoint_path": "/", "description": "Move or update a task"}, {"operation_name": "create_log", "http_method": "POST", "endpoint_path": "/", "description": "Write to the AI log"}, {"operation_name": "ask_question", "http_method": "POST", "endpoint_path": "/", "description": "Ask a question via dashboard"}, {"operation_name": "push_insight", "http_method": "POST", "endpoint_path": "/", "description": "Push analytics data"}, {"operation_name": "update_status", "http_method": "POST", "endpoint_path": "/", "description": "Update agent status ring"}, {"operation_name": "create_report", "http_method": "POST", "endpoint_path": "/", "description": "Generate HTML report"} ] } ``` ### 2. Office Animation ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "office-animation", "protocol_type": "REST", "base_url": "{CLAWBUDDY_API_URL}/functions/v1", "auth_type": "api_key", "status": "ready", "skill_operations": [ {"operation_name": "update_agent_status", "http_method": "POST", "endpoint_path": "/office-agent-status", "description": "Update animated office character"}, {"operation_name": "create_agent", "http_method": "POST", "endpoint_path": "/manage-office-agent", "description": "Add character to office"}, {"operation_name": "create_task", "http_method": "POST", "endpoint_path": "/create-office-task", "description": "Create task in office"}, {"operation_name": "list_offices", "http_method": "POST", "endpoint_path": "/list-offices", "description": "List all offices"} ] } ``` ### 3. Email Communication (Resend) ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "resend-email", "protocol_type": "SMTP", "base_url": "https://api.resend.com", "auth_type": "api_key", "status": "ready", "skill_operations": [ {"operation_name": "send_email", "http_method": "POST", "endpoint_path": "/emails", "description": "Send an email via Resend API"} ] } ``` ### 4. Intelligence Sync ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "intelligence-sync", "protocol_type": "REST", "base_url": "{CLAWBUDDY_API_URL}/functions/v1/ai-tasks", "auth_type": "api_key", "status": "ready", "skill_operations": [ {"operation_name": "sync_competitors", "http_method": "POST", "endpoint_path": "/", "description": "Sync YouTube competitor data"}, {"operation_name": "sync_ideas", "http_method": "POST", "endpoint_path": "/", "description": "Sync content ideas"}, {"operation_name": "sync_videos", "http_method": "POST", "endpoint_path": "/", "description": "Sync video analytics"}, {"operation_name": "sync_scripts", "http_method": "POST", "endpoint_path": "/", "description": "Sync video scripts"}, {"operation_name": "create_digest", "http_method": "POST", "endpoint_path": "/", "description": "Generate intel digest"}, {"operation_name": "get_digest", "http_method": "POST", "endpoint_path": "/", "description": "Retrieve latest digest"} ] } ``` ### 5. Morning Digest (Automation) ```json { "request_type": "skill", "action": "create", "agent_name": "<agent_name>", "skill_name": "morning-digest-boot-check", "protocol_type": "custom", "status": "ready", "skill_markdown": "# Morning Digest Boot Check\n\nThis automation runs at session start. It:\n1. Checks the queue for pending dispatches\n2. Reads STATUS.md for previous session state\n3. Checks agent_comms for unread messages\n4. Generates a morning briefing with today's priorities\n5. Posts the briefing to the AI log\n\nTrigger: Session start hook or scheduled cron\nOutput: Morning briefing log entry + Telegram alert" } ``` ## Step 2: Verify Skills List all registered skills: ```json {"request_type": "skill", "action": "list"} ``` This returns only `bujji_status: "accepted"` skills. You should see all 5 skills with their operations. ## Step 3: Run Validation (Optional) Submit a skill for the validation pipeline: ```json {"request_type": "skill", "action": "submit", "skill_id": "<skill_id>"} ``` Returns: validations (pass), issues (fail), warnings, and suggestions. ## Understanding Skill Types | Protocol | Use Case | Needs Operations? | |----------|----------|-------------------| | REST | API integrations (YouTube, Resend, etc.) | Yes — define endpoints | | SMTP | Email sending | Yes — send_email op | | custom | Complex workflows, automations | No — if skill_markdown >= 100 chars | ## Security: ClawHub vs Skills Factory | | ClawHub (Public) | Skills Factory (Private) | |---|---|---| | Skills | 3,286 | Your curated set | | Curation | Community reports | You control everything | | Malware risk | 20% in ClawHavoc | Zero — you wrote them | | Audit trail | Limited | Full DB history | | Agent binding | Filesystem | Database + API | | Validation | None | Built-in pipeline | ## Next Steps Once your base skills are set up: 1. Add YouTube Production Pipeline skills (13 skills for the content factory) 2. Create automation skills for your 5 server-side cron jobs 3. Build custom skills for any new API integration 4. Use the Forge to analyze content and discover new buildable skills

🛠️ Starter vs Production

This prompt creates a V1 scaffold. Production requires wiring real data sources, QA passes, error handling, retry logic, and safety gates. Treat the output as a working prototype — not a ship-ready system.