​

PawzHub — Marketplace

​

Three Tiers, One Marketplace

​

How It Works

1. Skill manifest declares what the skill does, what credentials it needs, and what data it outputs
2. Credential vault encrypts API keys with AES-GCM (key stored in OS keychain) and injects them into the agent prompt at runtime
3. Engine tools (fetch, exec, read_file, write_file) execute the actual API calls and commands
4. Dashboard widgets render structured output from skills as persistent visual cards

​

Skill Manifest Format

[skill]
id = "notion"
name = "Notion"
version = "1.0.0"
author = "yourname"
category = "productivity"
icon = "edit_note"
description = "Read and write Notion pages, databases, and blocks via the API"
install_hint = "Get your API key at https://www.notion.so/my-integrations"

[[credentials]]
key = "NOTION_API_KEY"
label = "Integration Token"
description = "Your Notion internal integration token"
required = true
placeholder = "secret_..."

[instructions]
text = """
You have access to the Notion API via the user's integration token.

## Reading pages
Use `fetch` with:
- URL: `https://api.notion.so/v1/pages/{page_id}`
- Headers: `Authorization: Bearer {NOTION_API_KEY}`, `Notion-Version: 2022-06-28`

## Searching
Use `fetch` with POST to `https://api.notion.so/v1/search`
Body: {"query": "search term"}

## Creating pages
Use `fetch` with POST to `https://api.notion.so/v1/pages`
Headers: `Authorization: Bearer {NOTION_API_KEY}`, `Notion-Version: 2022-06-28`
Body: {"parent": {"database_id": "..."}, "properties": {...}}
"""

[widget]
type = "table"
title = "Recent Pages"
refresh = "10m"

[[widget.fields]]
key = "title"
label = "Page"
type = "text"

[[widget.fields]]
key = "updated"
label = "Last Updated"
type = "datetime"

[[widget.fields]]
key = "status"
label = "Status"
type = "badge"

​

Manifest Fields

​

[skill] — Required

​

[[credentials]] — Optional (repeatable)

​

[instructions] — Required

• Which API endpoints to call (using the fetch tool)
• Which CLI commands to run (using the exec tool)
• How to format request headers, bodies, and authentication
• How to parse and present responses
• Error handling guidance

Credentials (use these values directly — do NOT ask the user for them):
- NOTION_API_KEY = secret_abc123...

​

[widget] — Optional

​

[[widget.fields]] — Required if [widget] is present

​

Widget Types

​

Status

[widget]
type = "status"
title = "Server Status"

[[widget.fields]]
key = "status"
label = "State"
type = "badge"

[[widget.fields]]
key = "uptime"
label = "Uptime"
type = "percentage"

[[widget.fields]]
key = "last_check"
label = "Last Check"
type = "datetime"

​

Metric

[widget]
type = "metric"
title = "Monthly Revenue"

[[widget.fields]]
key = "value"
label = "MRR"
type = "currency"

[[widget.fields]]
key = "change"
label = "vs Last Month"
type = "percentage"

​

Table

[widget]
type = "table"
title = "Active Issues"

[[widget.fields]]
key = "title"
label = "Issue"
type = "text"

[[widget.fields]]
key = "assignee"
label = "Assignee"
type = "text"

[[widget.fields]]
key = "priority"
label = "Priority"
type = "badge"

[[widget.fields]]
key = "updated"
label = "Updated"
type = "datetime"

​

Log

[widget]
type = "log"
title = "Recent Incidents"

[[widget.fields]]
key = "message"
label = "Event"
type = "text"

[[widget.fields]]
key = "severity"
label = "Level"
type = "badge"

[[widget.fields]]
key = "timestamp"
label = "When"
type = "datetime"

​

Key-Value (KV)

[widget]
type = "kv"
title = "Project Stats"

[[widget.fields]]
key = "total_records"
label = "Records"
type = "number"

[[widget.fields]]
key = "storage_used"
label = "Storage"
type = "text"

[[widget.fields]]
key = "last_sync"
label = "Last Sync"
type = "datetime"

​

Field Types

​

Installing Skills

​

From PawzHub (In-App)

1. Open the Skills tab in the sidebar
2. Click the Browse PawzHub section
3. Browse or search available skills by name or category
4. Click Install on any skill
5. Configure credentials if required
6. Assign to agents via Agents → [agent] → Skills

​

Manual Install

~/.paw/skills/{skill-id}/pawz-skill.toml

~/.paw/skills/notion/pawz-skill.toml
~/.paw/skills/linear/pawz-skill.toml
~/.paw/skills/stripe/pawz-skill.toml

​

Uninstalling

• Community skills: Click the Uninstall button in the Skills tab. This deletes the skill folder from ~/.paw/skills/ and cleans up stored credentials and enabled state.
• Core skills: Cannot be uninstalled (they’re compiled into the binary). Disable them per-agent in Agents → [agent] → Skills instead.

​

Creating Skills

​

In-App Wizard

1. Basic Info — name, category, icon, description
2. Credentials — add API key fields with labels and placeholders
3. Instructions — write or paste agent instructions (templates available for REST APIs, CLI tools, and web scrapers)
4. Widget — optionally declare dashboard output with field types
5. Test — enable the skill and verify it works with a live agent
6. Publish — save locally, export TOML, or publish directly to PawzHub via GitHub PR

​

AI-Assisted Creation

“Create a PawzHub skill for the Notion API”

​

Template Starters

• REST API — fetch calls with auth headers, JSON parsing
• CLI Tool — exec commands with flag reference
• Web Scraper — fetch + HTML parsing instructions

​

Publishing to PawzHub

​

Submission Flow

1. Fork the elisplash/pawzhub repository
2. Create skills/{your-skill-id}/pawz-skill.toml
3. Open a Pull Request — CI validates your manifest automatically
4. Maintainer reviews and merges
5. registry.json is auto-rebuilt — your skill appears in the in-app browser

​

One-Click Publish (from Pawz)

1. Click Publish to PawzHub in the wizard’s final step
2. Pawz opens a pre-filled GitHub PR on elisplash/pawzhub
3. CI validates, maintainer reviews, done

​

CI Validation

​

Quality Guidelines

• Valid, well-tested pawz-skill.toml
• Clear, accurate description
• Working instructions that the agent can follow

• Tested in a real Pawz workspace
• Includes a widget for dashboard output
• Screenshot or demo in the PR description
• Created using the in-app wizard

​

Skill Architecture Deep Dive

​

How Credentials Flow

​

How Instructions Work

# Enabled Skills
You have the following skills available. Use exec, fetch,
read_file, write_file, and other built-in tools to leverage them.

## Notion Skill (notion)
You have access to the Notion API via the user's integration token.
[... full instructions ...]

Credentials (use these values directly — do NOT ask the user for them):
- NOTION_API_KEY = secret_abc123...

## Linear Skill (linear)
[... instructions ...]

​

How Widgets Work

1. Skill manifest declares a [widget] with type and fields
2. Agent runs the skill and produces structured JSON matching the widget schema
3. Agent calls the skill_output tool to persist the data
4. Dashboard reads skill_outputs table and renders the widget card
5. Optional refresh interval triggers periodic re-fetching

​

Security Model

​

What Community Skills Can Do

• Inject text into the agent’s system prompt (instructions)
• Declare credential fields (encrypted by the engine, never handled by the skill)
• Declare widget schemas (rendered by the app, not by the skill)

​

What Community Skills Cannot Do

• Execute arbitrary Rust code (no compiled tool functions)
• Bypass domain allowlist/blocklist (enforced by execute_fetch)
• Access the OS keychain directly (credential injection is engine-side)
• Read engine source code (blocked by execute_read_file)
• Install blocked packages (enforced by execute_exec)
• Run unsandboxed commands when Docker sandbox is enabled

​

Runtime Protections

​

PawzHub vs. Other Skill Registries