Workspace

Prometheus monitoring — PromQL instant/range queries, metric discovery, metadata, scrape target health, system health checks (6 tools). Use when querying Prometheus metrics, checking scrape targets, investigating alert thresholds, or analyzing network device utilization trends.

Deliver formatted network reports, audit results, topology diagrams, and compliance documentation to Slack channels with rich Block Kit formatting. Use when posting a health check report, sharing a security audit, delivering topology diagrams, or sending scheduled network reports to Slack.

Respond to Slack voice clips with both text and an MP3 voice reply using edge-tts. Voice IN is already handled by OpenClaw transcription. Use when a user sends a voice message in Slack, you need to reply with audio, or you want to generate a spoken MP3 response.

Cisco ThousandEyes — test management, agent inventory, test results, dashboards, path visualization, user/account management. Use when checking ThousandEyes test results, viewing network monitoring dashboards, listing agents, investigating alerts, or assessing overall network performance.

Deliver formatted network reports, audit results, topology diagrams, and compliance documentation to WebEx spaces with Adaptive Cards and markdown formatting. Use when posting a health check report, sharing a security audit, delivering topology diagrams, or sending scheduled network reports to WebEx.

Respond to WebEx voice clips with both text and an MP3 voice reply using edge-tts. Voice IN is already handled by OpenClaw transcription. Use when a user sends a voice message in WebEx, you need to reply with audio, or you want to generate a spoken MP3 response.

Review current and historical problems from Zabbix — severity, which host, when it started, how long it has been active, and whether anyone has acknowledged it. Use when someone asks what is broken right now, how long something has been broken, or what happened during a window that has already passed.

Check whether a running Cisco software version is affected by a published PSIRT security advisory - by OS version, CVE, or advisory ID, with severity and CVSS. Covers IOS, IOS-XE, NX-OS, ASA, FTD, FMC and ACI. Use when asked if a device or fleet is vulnerable, when triaging a Cisco CVE, or when auditing software versions against Cisco advisories.

Search Cisco Catalyst Center API documentation for device management and policy automation

Build or rewire EVE-NG lab topology. Use when creating or deleting virtual networks, connecting node interfaces to networks, inspecting topology links, checking interface mappings, or listing available node templates before wiring a lab.

Manage EVE-NG node lifecycle. Use when listing nodes, checking runtime state, creating or deleting nodes, starting or stopping nodes or whole labs, verifying node details, or wiping node NVRAM back to factory defaults.

Manage GNS3 network lab projects - create, open, close, delete, clone, export/import

List Kubernetes workloads and namespaces — pods with their node, phase and readiness, plus events. Use when asked what is running, where it is running, what is failing, or for a general inventory of a cluster.

Service fingerprinting, OS detection, NSE script execution, and vulnerability scanning using nmap MCP. Use when identifying services on open ports, fingerprinting OS versions, running NSE scripts for SSL or SMB checks, or scanning for known CVEs and vulnerabilities

Live BGP and OSPF control-plane participation — peer with real routers, inject/withdraw routes, query RIB/LSDB, adjust metrics, GRE tunnel status. Use when injecting or withdrawing BGP routes, checking BGP peer state, querying the OSPF LSDB, or testing route advertisement in a lab.

JunOS interface operations via pyATS — physical/logical interfaces, LACP, CoS, LLDP, ARP, BFD, IPv6 neighbors, traffic monitoring, optics diagnostics. Use when checking Juniper interface status, auditing LACP members, inspecting optics power levels, or reviewing ARP and LLDP neighbors.

Turn a real network topology into a free, no-cost themed prompt preview, and optionally (after explicit confirmation) generate an explorable, AI-generated 3D 'world' via World Labs Marble — a decorative companion visualization, never a substitute for the accurate topology diagram it is derived from. Use when the operator asks for a fantastical, explorable, or AI-generated 3D world/scene of a network topology.

Retrieve polled metric history from Zabbix — interface utilization, counters and any collected item — over any time window, correctly routed between raw history and hourly trends. Use when someone asks what something WAS doing over time: is this normal, what did this interface do overnight, was it like this last Tuesday. This is the only NetClaw skill that can answer a question about the past from a poller.

Core academic workspace tools: LaTeX compilation, Jupyter execution, PDF loading, UI control, content updates, and arXiv paper conversion. Use when the user asks to compile LaTeX, run Python code, load PDFs, display data, or control workspace editors.

Batfish network configuration analysis -- pre-deployment validation, reachability testing, ACL/firewall tracing, differential analysis, compliance checking. Use when validating configs before deployment, testing traffic paths, tracing ACL rules, comparing config versions, or auditing compliance policies. Strictly read-only.

Discover and classify OT / IoT / IoMT assets via Claroty xDome. List devices by site, Purdue level, and device purpose; assign Purdue layers and custom attributes; cross-reference with Nautobot / NetBox SoT to surface drift.

Design EVE-NG lab topology and coordinate the design workflow. Use when the user asks for lab design, architecture advice, topology planning, design review, or a build plan, especially when requirements, trade-offs, or validation need to be structured first.

Manage event orchestration and routing rules in PagerDuty.

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in Slack, tracking incident status, or running a post-incident review.

Manage network incident response workflows in Cisco WebEx - incident spaces, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in WebEx, tracking incident status, or running a post-incident review.

AWS architecture diagrams — generate visual network topology diagrams from live AWS infrastructure. Use when drawing AWS network diagrams, visualizing VPCs, mapping Transit Gateway topology, or generating architecture documentation.

Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is, or to reconcile controller state against the devices themselves.

The four standard NetClaw document compositions — a change-record Word document from a real ServiceNow CR plus device state, an interface/config audit workbook from real device queries, an executive summary deck with an embedded topology diagram, and a required PDF form filled from real data. Use when an operator asks for a deliverable to attach to a change record, hand to an auditor, or put in front of a director.

Reason over BGP topology as a whole -- speakers, peering sessions, the route table, VRF/VPN membership, and whether a BGP epoch is bound to a stored IGP graph. Use when the question is about what the BGP control plane believes (learned routes, session state, VRF placement, BGP-to-IGP correlation) rather than what one live device's BGP table currently shows. Read-only.

Reason over the OSPF/IS-IS link-state topology as a whole — shortest and backup paths, per-area LSDB, edge and node failure simulation, MPLS-TE/CSPF feasibility, and a timeline of topology change events. Use when the question is about what the IGP believes the topology is, or what it would do if a link or node failed, rather than what one live device's routing table currently shows. Read-only.

Cisco Meraki MX security appliance (read-only) — L3/L7 firewall rules, content filtering, IDS/IPS and AMP settings, site-to-site VPN, traffic shaping via Cisco's official Meraki MCP. Use when auditing Meraki firewall rules, reviewing content filtering, or inspecting MX VPN configuration

Gather missing requirements for EVE-NG topology design. Use when the request is vague or incomplete, when you need discovery questions, defaults, trade-off framing, image recommendations, or domain guidance before proposing a topology.

Measure a public endpoint from thousands of probes worldwide - ping, traceroute, DNS, MTR and HTTP from real vantage points on the internet. Use when asked whether the outside world can reach a service, to compare latency between regions, to check DNS propagation, or to answer 'is it us or the internet?'. Public targets only.

Full ITSM-gated change lifecycle - CR creation, pre-change incident validation, approval gate, execution via pyats-config-mgmt, post-change verification, and closure with GAIT audit trail. Use when creating a change request, making a network change that needs approval, tracking change management, or following ITIL change process.

Authoring playbook for building agents that search, read, and synthesize information into a report. Use this when the user wants an agent to research a topic, summarize sources, compare options, do competitive analysis, monitor news, generate briefs, or pull together a citation-backed report from the web or internal documents.

Validate EVE-NG topology designs and enforce final delivery structure. Use when reviewing a design, checking build readiness, producing the final design output, building an implementation plan, or running topology QA before implementation.

Fallback authoring playbook for building general-purpose personal assistant agents that do not fit a more specific archetype. Use this only after checking the other archetype skills (coding, spreadsheet, research, customer-support, content-writer, ops-automation). Examples include summarizing emails, drafting short answers, capturing notes, or generic personal-helper agents.

Authoring playbook for building agents that read or write tabular data — Google Sheets, Microsoft Excel, CSV, Airtable, Notion databases, or any spreadsheet. Use this when the user wants an agent that updates rows, reads cells, computes totals, generates reports from sheets, syncs data between spreadsheets, or automates anything involving rows, columns, ranges, or worksheets.

Authoring playbook for building agents that draft written content — blog posts, marketing copy, social media posts, newsletters, product descriptions, landing pages, or ad copy. Use this when the user wants an agent that writes, drafts, or rewrites text for publication or marketing.

Authoring playbook for building agents that automate recurring internal tasks — running scheduled workflows, syncing data between systems, posting notifications, processing inbound events, or executing operational runbooks. Use this when the user wants an agent that runs on a schedule, reacts to events, automates a process, syncs between tools, or handles ops/internal infrastructure.

Authoring playbook for building agents that triage and reply to customer messages — support tickets, email inquiries, chat questions, refund requests, or product issues. Use this when the user wants an agent that handles inbound customer questions, drafts replies, escalates hard cases, summarizes tickets, or follows a support playbook.

Universal quality bar and final audit rubric for any agent system prompt. Activate this whenever you are unsure which archetype skill applies, or as a final review pass before writing the system prompt. It defines the required run contract, completion criteria, fallback paths, response format, and anti-patterns every produced agent prompt must satisfy.

Structured Kepner-Tregoe (K-T) rational-process methodology for network operations. Use this whenever diagnosing a network fault, outage, or performance deviation; triaging multiple concurrent alarms or an alert storm; choosing between remediation options, designs, or vendors; or planning and protecting a network change, migration, or upgrade. Apply it to ANY network troubleshooting task — routing/BGP, wireless/RF, firewall/security, SD-WAN/overlay, DNS/DHCP, cloud/hybrid connectivity, or performance — even when the request is only "why is X down", "figure out what's wrong", or "the network is slow". It exists to stop guess-and-swap troubleshooting: it forces you to specify the fault's boundary before hypothesizing, test causes against evidence, verify the root cause before changing anything, and separate the fast reversible incident fix from the permanent fix. Consult it before making state-changing actions on a network.

Code quality standards and style guide for reviewing pull requests