feat: publish Crabbox sandbox quickstart for skills.sh

[zozo123]

Make Crabbox's sandbox execution skills easy to install with the skills.sh CLI. The existing crabbox skill covers sandbox execution, reusable remote environments and evidence; the new crabbox-quickstart teaches a first credential-free Docker/Podman run and cleanup.

npx skills add openclaw/crabbox --skill crabbox
npx skills add openclaw/crabbox --skill crabbox-quickstart

The quickstart command becomes available from upstream after merge. Skills install agent instructions; the Crabbox CLI is installed separately. As skills.sh documents, leaderboard discovery comes from CLI installation telemetry. This PR does not claim the unmerged quickstart is already indexed.

Changes

• Add the 153-line quickstart and its byte-identical agent projection.
• Publish both canonical skills through crabbox.sh discovery, AI Catalog and llms.txt; trigger Pages on any skill change.
• Make sandbox installation prominent in the README and explain GitHub installation versus domain discovery.
• Correct retained local-container lifecycle guidance: warmup and --keep need explicit stop.
• Replace the overflowing skill-selection table with wrapping choices.
• Preserve crabbox as the first discovery entry even with an alphabetically earlier skill; reject missing/invalid catalog names and string arrays.
• Extend the existing browser-proof workflow to check the actual desktop/mobile guide and both HTTP skill downloads/digests.

The existing crabbox skill is unchanged. Changelog edits remain with maintainers. No configuration, credential or provider-runtime changes.

Verification of 16ea048

• Skills CLI 1.5.24 installed both selected skills from the updated local checkout into an isolated Codex project; installed files matched canonical bytes.
• 19/19 publishing and enhancement tests passed, including ordering and malformed catalog fixtures.
• Skill projection checks, 246-file internal link check, skill frontmatter validation and git diff --check passed.
• Playwright/Chromium browser proof: 169/169 assertions passed, including skill-choice fit at 1440px and 390px, live HTTP discovery, and SHA-256 verification of both downloads.
• GitHub Actions Docs UI Proof also passed for this head.
• Full check-docs.sh could not run its command-help checks locally because Go is unavailable. Earlier Docker walkthrough evidence is recorded in the PR history; it was not rerun for this documentation/publishing correction. Other CI jobs are still running.

Proof report · Browser assertions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 1:11 AM ET / 05:11 UTC.

ClawSweeper review

What this changes

Adds a beginner local-container skill and updates website publishing, discovery checks, installation guidance, and browser proof to support both Crabbox skills.

Merge readiness

✅ Ready for maintainer review

This PR remains useful: current main and v0.51.0 publish only the existing crabbox skill. The earlier cleanup, layout, ordering, and catalog-validation concerns are resolved, and the refreshed proof supports the changed publishing and installation guide.

Priority: P3
Reviewed head: 16ea048cbd8e570c461f48a2a8ea61ecdd468862

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, adequately proven publishing change with the previous actionable review concerns addressed.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The captured head-specific installer and Chromium results exercise canonical skill installation and generated HTTP downloads with matching digests; locally inspected screenshots directly demonstrate the repaired guide layout. Linked raw report retrieval was unavailable, a reviewer limitation rather than missing contributor proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The captured head-specific installer and Chromium results exercise canonical skill installation and generated HTTP downloads with matching digests; locally inspected screenshots directly demonstrate the repaired guide layout. Linked raw report retrieval was unavailable, a reviewer limitation rather than missing contributor proof.
Evidence reviewed	8 items	Repository policy and ownership: Read the complete root AGENTS.md and verified origin as openclaw/crabbox. The only additional tracked AGENTS.md is under the unrelated autoreview skill; no maintainer-notes directory exists. Applied generic-product, generated-output, and contributor changelog guidance. Current main still publishes one skill: The current-main builder reads skills/crabbox/SKILL.md directly and emits a single discovery entry; its skills tree contains no quickstart. This establishes meaningful remaining work rather than an implemented-on-main closure. Latest release comparison: The supplied v0.51.0 release revision contains only skills/crabbox/SKILL.md under skills; the proposed quickstart is not present.
Findings	None	None.
Security	None	None.

How this fits together

Crabbox’s documentation builder turns repository skill files into downloadable instructions and discovery catalogs. Skill installers consume those files to teach coding agents how to run Crabbox.

flowchart LR
  A[Canonical skill files] --> B[Validate metadata and copies]
  B --> C[Documentation builder]
  C --> D[Installation guide]
  C --> E[Discovery catalog and downloads]
  E --> F[Agent skill installers]
  F --> G[Crabbox usage instructions]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Net line growth	Production scripts +86; tests and browser proof +148; docs and skills +342	Production growth supports publishing multiple skills; documentation growth includes two identical 153-line quickstart copies.

Technical review

Best possible solution:

Publish the bounded quickstart through the existing discovery pipeline while preserving the full skill’s payload and directing advanced tasks back to it.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the central skill-publication feature; the earlier layout defect is visibly resolved in the refreshed desktop and mobile screenshots.

Is this the best way to solve the issue?

Yes. Extending the existing publisher preserves one discovery implementation, while the short quickstart delegates advanced usage to the unchanged full skill.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e59130d1999a.

Labels

Label justifications:

• P3: This is a bounded skill-discovery and onboarding improvement without changes to provider execution or user configuration.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The captured head-specific installer and Chromium results exercise canonical skill installation and generated HTTP downloads with matching digests; locally inspected screenshots directly demonstrate the repaired guide layout. Linked raw report retrieval was unavailable, a reviewer limitation rather than missing contributor proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured head-specific installer and Chromium results exercise canonical skill installation and generated HTTP downloads with matching digests; locally inspected screenshots directly demonstrate the repaired guide layout. Linked raw report retrieval was unavailable, a reviewer limitation rather than missing contributor proof.

Evidence

What I checked:

• Repository policy and ownership: Read the complete root AGENTS.md and verified origin as openclaw/crabbox. The only additional tracked AGENTS.md is under the unrelated autoreview skill; no maintainer-notes directory exists. Applied generic-product, generated-output, and contributor changelog guidance. (AGENTS.md:1, 16ea048cbd8e)
• Current main still publishes one skill: The current-main builder reads skills/crabbox/SKILL.md directly and emits a single discovery entry; its skills tree contains no quickstart. This establishes meaningful remaining work rather than an implemented-on-main closure. (scripts/build-docs-site.mjs:107, e59130d1999a)
• Latest release comparison: The supplied v0.51.0 release revision contains only skills/crabbox/SKILL.md under skills; the proposed quickstart is not present. (skills/crabbox/SKILL.md:1, 745eb21f8fb9)
• Introduced publishing changes and resolved review requests: Inspected the complete introduced script diff. The publisher explicitly keeps crabbox first, validates catalog names and string arrays, preserves the original entry’s fields, and publishes canonical bytes with digests. Focused fixtures cover earlier-sorting skills and malformed metadata. The workflow change only broadens the existing Pages path filter. (scripts/build-docs-site.mjs:146, 16ea048cbd8e)
• Review continuity: The current quickstart explicitly requires stopping retained containers, and the guide replaces the overflowing table with wrapping list choices. These address both prior findings. Ordering, catalog validation, and the generated-test comment also address the requests in feat: publish Crabbox sandbox quickstart for skills.sh #1911 (comment). The existing crabbox skill is unchanged and both quickstart copies compare identically. (skills/crabbox-quickstart/SKILL.md:140, 16ea048cbd8e)
• Refreshed real behavior proof: Inspected both prepared screenshots sourced from this pinned proof revision: the desktop and mobile skill choices fit their article. The captured PR body binds verification to head 16ea048 and reports Skills CLI 1.5.24 installing both canonical payloads, plus Chromium HTTP discovery and digest checks among 169 passing assertions. The earlier review records Docker walkthrough evidence. Direct retrieval of the linked report and assertion JSON failed with DNS resolution errors and browser cache misses; their full contents were not independently inspected. (pr-proof/1911/README.md, 37347515b0a6)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-09-06T10:29:06.883Z sha 7d426d6 :: blocked before merge. :: [P3] Leave the release-note addition to maintainers
• reviewed 2026-09-06T13:02:02.987Z sha a8bbed2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-06T13:19:38.212Z sha 21d18e3 :: blocked before merge. :: [P3] [P3] Leave the release-note addition to maintainers
• reviewed 2026-09-06T14:55:37.551Z sha 952ed2b :: needs real behavior proof before merge. :: [P3] Fit the skill selection table within the article
• reviewed 2026-09-06T16:18:53.595Z sha 0b0daa7 :: needs real behavior proof before merge. :: [P3] Fit the skill selection table within the article
• reviewed 2026-09-06T17:25:20.327Z sha fc51d7e :: needs real behavior proof before merge. :: [P2] Remove the automatic-expiry promise for retained local containers | [P3] Fit the skill selection table within the article

[steipete]

The quickstart rewrite is now on 21d18e3d5ffae57c0b4415490fd2d619b47f04e9. I have paused my landing attempt and will leave this author-owned update intact. The maintainer installer/browser proof from a8bbed29a77a6f24a7a07f55b7e94a7b77649bca covers the previous software-factory revision, not the new quickstart payload.

The replacement also dropped three mechanical fixes that are independent of the skill's subject:

• Stable discovery: plain .sort() does not guarantee the existing crabbox entry stays first if another valid directory sorts earlier. The earlier alpha/crabbox/zeta characterization test and explicit first-entry ordering addressed that claim.
• Catalog validation: the builder again copies parsed JSON without checking displayName or the string-array fields. Missing fields can disappear from the published catalog, and tests comparing absent expected/actual properties can still pass. The removed malformed-metadata tests covered this.
• Readable skill table: the three-column table and unconditional 680px minimum are back. The earlier real-Chrome check found overflow at the standard article width; the compact-table rule and two-column selection table fixed that while preserving wider tables' scrolling behavior. Fresh quickstart UI proof is still needed; I am not treating the old screenshot as a check of this rewrite.

Please retain or deliberately replace those fixes/tests while keeping the quickstart direction. The generated-test comment is also stale: importing the builder already generates the site before test registration. I am continuing the separate provider work rather than force-pushing over this revision.