Agent skill · steipete
cloud-image-bake
Bake, select, prove, and safely retire a Cloud Worker image with crabbox and config one-liners.
What it needs
About 2k tokens when loaded.
What this skill does
Bake a Cloud Worker image Never print or persist secret values; provider credentials stay in their stores. Never hand-edit config files on disk — profile changes go through openclaw config. Every run ends with the observable Prove result or an exact explanation of why it could not be proven. Snapshots are cheap; unmanaged snapshot sprawl is not. Never delete a provider image without hard operator confirmation. Gather Record the current provider, class, image selection, setup command, and the id of the image being superseded. Confirm the requested tooling and a secret-free bake source. Mutate Lease from the current profile, install and smoke-test the tooling: Snapshot per backend: AWS: crabbox checkpoint create --provider aws --id <lease> --mode native --strategy image --wait, inspect it, then crabbox image promote <ami-id> with the matching scope. AWS image selection is owned by the promote catalog. Hetzner: hcloud image create --type snapshot --server <server-id> --description <name>; there is no crabbox create/promote lifecycle for Hetzner yet, so record the snapshot id explicitly. Firecracker: rebuild and republish the rootfs template through the host's template pipeline; do not snapshot a running microVM as a substitute. Point the profile at the new selection only through validated config writes — confirm the exact key first, dry-run, then write (example for a backend whose settings carry an image field): The bundled crabbox profile currently has no image settings key — AWS selection lives in crabbox image promote; never invent a config field. Preserve the old image until proof passes. Repair doctor --lint can exit 1 for findings: read the report and continue the remaining checks. Ordinary doctor and doctor --non-interactive can write config/state; do not use them for diagnosis before approval. Apply openclaw doctor --fix --non-interactive only after explicit approval, then re-read the profile and provider inventory. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills steipete/cloud-image-bake