Prepare Cloud Worker images with tools already installed, select the new image, and verify startup timing and session placement. The workflow covers rollback when verification fails and removal of superseded images after explicit confirmation.
Bake, select, prove, and safely retire a Cloud Worker image with crabbox and config one-liners.
This skill creates Cloud Worker images with the required tools already installed, then verifies startup and operation. It examines current settings and images, installs and checks the tools, and switches to a new image. Alongside comparing startup times before and after the change, it checks whether a session sent from an OpenClaw client reaches the active state. If verification fails, it restores the previous image selection.
It is intended for operators who want Cloud Worker tools available before startup, or need to measure how an image change affects startup time. It also covers cleaning up old snapshots.
The workflow uses openclaw and crabbox; image creation differs across AWS, Hetzner, and Firecracker. Hetzner requires hcloud, while Firecracker requires a host-side template creation process. Configuration changes go through openclaw config. Secret values must not be displayed or saved. Automatic repair and deletion of old images require explicit approval. Keep the previous image until verification is complete.
This overview was written by AI (OpenAI Codex) from the public SKILL.md. Check the original below for the exact behavior.
AI rated this skill on four points using only the contents of its SKILL.md. Stars and popularity are not taken into account.
The total counts each point as A = 25, B = 15, C = 5. Rated by AI (OpenAI Codex) as of Oct 19, 2026. Treat it as a guide and read the original before installing.
Review the instructions the agent will receive before you install.
Never print or persist secret values; provider credentials stay in their stores. Never hand-edit config files on disk — profile changes go through openclaw config. Every run ends with the observable Prove result or an exact explanation of why it could not be proven. Snapshots are cheap; unmanaged snapshot sprawl is not. Never delete a provider image without hard operator confirmation.
openclaw config get cloudWorkers --json
crabbox config show --json
crabbox doctor --provider <backend> --json
crabbox checkpoint list --json
Record the current provider, class, image selection, setup command, and the id of the image being superseded. Confirm the requested tooling and a secret-free bake source.
Lease from the current profile, install and smoke-test the tooling:
crabbox warmup --provider <backend> --class <class> --keep --timing-json
crabbox run --provider <backend> --id <lease> --no-sync -- bash -lc '<install commands> && <tool> --version'
Snapshot per backend:
crabbox checkpoint create --provider aws --id <lease> --mode native --strategy image --wait, inspect it, then crabbox image promote <ami-id> with the matching scope. AWS image selection is owned by the promote catalog.hcloud image create --type snapshot --server <server-id> --description <name>; there is no crabbox create/promote lifecycle for Hetzner yet, so record the snapshot id explicitly.Point the profile at the new selection only through validated config writes — confirm the exact key first, dry-run, then write (example for a backend whose settings carry an image field):
openclaw config schema --json | jq '.properties.cloudWorkers'
openclaw config set cloudWorkers.profiles.<profile>.settings.<imageKey> "<image-id>" --dry-run
openclaw config set cloudWorkers.profiles.<profile>.settings.<imageKey> "<image-id>"
The bundled crabbox profile currently has no image settings key — AWS selection lives in crabbox image promote; never invent a config field. Preserve the old image until proof passes.
openclaw doctor --lint
crabbox doctor --provider <backend> --json
doctor --lint can exit 1 for findings: read the report and continue the remaining checks. Ordinary doctor and doctor --non-interactive can write config/state; do not use them for diagnosis before approval. Apply openclaw doctor --fix --non-interactive only after explicit approval, then re-read the profile and provider inventory.
Lease once from the new image and verify the baked tooling is present and fast:
crabbox warmup --provider <backend> --class <class> --timing-json
crabbox run --provider <backend> --id <lease> --no-sync -- bash -lc '<tool> --version'
crabbox stop --provider <backend> --id <lease>
Record warmup total and compare against the pre-bake timing. Then confirm the OpenClaw path end to end: dispatch one session to the profile from a client (Cloud destination) and verify the placement reaches active. If any step fails, roll back the image selection and report the exact blocker.
Report the profile, backend, new and previous image ids, tooling smoke result, timed warmup before/after, and rollback state. Only after successful proof, show the exact deletion target and get hard operator confirmation, then delete only that superseded snapshot (crabbox image delete <id> or hcloud image delete <id>) and verify it is gone. Without confirmation, leave it intact and report cleanup pending.
Further reference: https://docs.openclaw.ai/gateway/cloud-workers
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Set up and authenticate the 1Password CLI, then supply stored passwords and API keys to commands or configuration. The skill covers desktop integration, service accounts, and interactive sign-in while keeping secrets out of chat and logs.
Route requests from OpenClaw to external coding agents such as Claude Code or Cursor. Start or continue sessions using ACP, a protocol for connecting agents, or relay prompts directly through acpx while preserving conversation context.
Add a model provider to OpenClaw and verify it with a real response. The skill validates configuration, keeps credentials in environment or file references, and reports test results and any default model changes.
Prepare an agent activity transcript for a GitHub pull request or issue. Extract relevant prompts, decisions, and results from local logs, remove sensitive material, and preview the edited record before separately authorized publication.
Manage Apple Notes on macOS through memo, a command-line tool. Create, browse, search, edit, delete, and move notes between folders, or export selected notes to HTML or Markdown for use outside the app.
Manage Apple Reminders from your Mac with remindctl, a terminal tool. View tasks by date, add or edit reminders, organize lists, and mark tasks complete or delete them, including personal to-dos that sync to iOS.