Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Key updates from v1.4.0 → v1.5.0: - Description: Added ORGA reasoning loop, Cedar policy authorization, knowledge bridge - What Makes Symbiont Unique: Added 4 new bullet points (ORGA, Cedar, Knowledge Bridge, Durable Journal); updated crypto verification to mention AgentPin - New section: Agentic Reasoning Loop — covers minimal loop setup, typestate phase transitions, all 7 journal event types, Cedar policy gate with entity type mapping, and knowledge bridge integration - Documentation links: Added reasoning-loop.md and security-model.md, removed stale tool_review_workflow.md link
What This Skill Does
Symbiont is an agent runtime for building secure, policy-enforced AI agents using a declarative DSL. It implements a typestate-enforced ORGA reasoning loop (Observe-Reason-Gate-Act), Cedar-based authorization, and multi-tier sandboxing via Docker, gVisor, and Firecracker. Compliance patterns for HIPAA, SOC2, and GDPR are built in.
Policy enforcement happens at the framework level via Cedar authorization and compile-time phase transitions, so security rules cannot be bypassed by mistakes in agent logic.
When to use it
- Processing GitHub webhook events with HMAC signature verification
- Running scheduled data archival or cleanup agents on cron schedules
- Orchestrating multi-step workflows with failure recovery and circuit breakers
- Building parallel API aggregators that call multiple external services
- Scanning codebases for vulnerabilities inside isolated gVisor sandboxes
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Build a webhook processor that validates GitHub PR event signatures and routes opened pull request events to a code review agent
- 1Define a webhook block with the GitHub provider preset and a vault-referenced HMAC secret
- 2Write a webhook_processor agent with a policy allowing JSON parsing but denying code execution and file access
- 3Verify the X-Hub-Signature-256 header using the verify_hmac_sha256 built-in before touching the payload
- 4Configure a filter on $.action == 'opened' so only relevant events reach the agent
- 5Set memory to ephemeral and timeout to 5000ms, returning HTTP 200 on success or 401 on invalid signature
A deployed /hooks/github endpoint that validates GitHub signatures, filters for opened PR events, and routes them to the code review agent while rejecting all others with HTTP 401