workshop-build-an-agent: Skill for Claude Code

setup-workshop-nemoclaw-operator (host side)

Prepares an OpenShell/NemoClaw sandbox so the in-sandbox agent can stand up the Build-an-Agent workshop, then opens the access path from the user's laptop to the resulting JupyterLab. This is one half of a two-skill pair:

Skill	Runs	Does
this skill	on the sandbox host (outside)	egress policy, secrets staging, kick + unblock the sandbox agent, port-forward, lifecycle
setup-workshop-nemoclaw	inside the sandbox	venv + deps, netlink shim, launcher/bridge fixes, Jupyter launch, URL hand-off

Should this skill run at all?

The workshop's DEFAULT setup path is the setup-workshop skill — the standard installer for the ordinary pathways (bare metal on Brev, local install via AI Workbench, GPU hosts). A generic request like "set up the build-an-agent workshop" goes there, not here.

Invoke this skill ONLY when at least one of these is true:

1. The user names it explicitly (setup-workshop-nemoclaw-operator, or asks for the "nemoclaw operator" setup skill), or
2. The user explicitly says the workshop should run with "NemoClaw" or inside an "OpenShell" sandbox.

If neither holds, stop and use setup-workshop instead — do not infer the sandbox path from circumstantial evidence (e.g. a sandbox merely existing on the host).

Which side am I on?

On the host (use this skill): docker ps shows an openshell-<sandbox>-… container, the openshell CLI is on PATH, and you are NOT user sandbox. Inside the sandbox (use the other skill): whoami → sandbox, /sandbox/ exists, no docker/sudo.

Conventions

SANDBOX=hermes-direct                                    # the sandbox name (adjust)
# Its container — exact, fail-closed selection by OpenShell runtime labels
# (substring grep can match a similarly named sandbox, e.g. hermes-direct-2):
C=$(docker ps --filter 'label=openshell.ai/managed-by=openshell' \
              --filter "label=openshell.ai/sandbox-name=$SANDBOX" --format '{{.Names}}')
[ "$(printf '%s\n' "$C" | grep -c .)" -eq 1 ] || echo "FATAL: not exactly one container for '$SANDBOX': ${C:-none}"
# NemoClaw community example: the deployment (scripts + policy.yaml + .env)
# and the workshop skills ship together in
cd <nemoclaw-community>/examples/recipes/nvidia/agentic-ai-learning-path