Skills & integrations

Skills and integrations are how agents gain abilities beyond conversation.

Skills#

A skill packages a capability an agent can use — often an HTTP tool, sometimes pure guidance. There are four sources:

• Marketplace (ClawHub) — install ready-made skills.
• Custom — author your own.
• OpenAPI import — paste a REST API's spec and generate a skill automatically (see below).
• Agent-proposed — an agent can propose a new skill via a skill-write block, which you approve.

Ceiling — Installing a skill (skill_install) is never auto-approved. A skill's instructions become the agent's knowledge, so trusting one by name opens a content-drift risk — a human always reviews the install. Whether members can install or must request is a policy setting.

When an agent calls a skill's tool, credentials are substituted server-side — the agent never sees the secret value — and outbound calls are guarded against reaching localhost or private network ranges.

Import from OpenAPI#

Most systems — internal APIs and SaaS alike — publish an OpenAPI (formerly Swagger) specification: a machine-readable list of everything the API can do. On the Skills page, choose Import → OpenAPI, paste the spec's URL (or paste the file, or upload it), and damn.dev turns it into a governed skill:

1. Pick the operations you want, grouped by tag. A big API becomes a handful of tools you choose, not hundreds you didn't.
2. Name the skill and, if the spec only has a relative server path, supply the base URL.
3. Import. Each selected operation becomes a tool, wired correctly to the API's paths, query parameters, request bodies, and auth header.

Governance is applied the same way as any other skill, by default:

• Read operations (GET) can be auto-approved so they don't stop for a human on every call. This is a checkbox you see and control, and it's off by default on a Regulated posture.
• Write operations (POST/PUT/PATCH/DELETE) always ask for approval.
• The skill starts disabled for every agent until you enable it — importing is not granting.
• Secrets the API needs (an API key, a bearer token) are surfaced by name so you can add them in Settings; they're substituted server-side at call time.
• A Test button runs one live call so you can confirm the wiring and credentials actually work, instead of hoping.

Ceiling — Import covers REST APIs described by an OpenAPI/Swagger spec. APIs secured with OAuth2 can't be wired automatically yet — the importer flags them and you paste a token as the secret. External $refs in a spec are not fetched (a safety measure), and a spec with only a relative server URL needs you to supply the base URL.

The browser skill#

The built-in browser drives a real, stealth-capable Firefox with 12 tools. Read-tier tools (navigate, snapshot, read) are auto-approved; interactive tools (click, type) stay human-gated; raw devtools access is always gated.

Ceiling — The first time an agent browses, it downloads a ~363 MB Firefox + GeoIP bundle (Docker images pre-bake it; npm and desktop download it on first use), and each actively-browsing agent uses ~150 MB of RAM with its own profile.

Obsidian#

Connect an Obsidian vault and agents can read (and optionally write) your notes. It's read-only by default — flip it to read/write explicitly.

External chat channels#

Agents can live where your team already is:

• Telegram — a per-agent bot with risk-tiered inline approvals and multi-user pairing. Configure it in the agent's Channels tab.
• WhatsApp — a per-agent number linked by QR code, with an Open or Invite-only inbox.

Note — If WhatsApp shows "Can't link new devices right now," that's usually a protocol-version staleness or an account-side link cooldown, not a damn.dev bug — see Doctor & troubleshooting.

Slack is coming soon. Discord is not on the near-term roadmap. Don't plan a rollout around either yet.

Next#

• Models, providers & secrets — the credentials skills use.
• Per-agent access — scoping which agent can use which secret.