🤖 Session 3: Copilot Prompts

Two live Copilot moments: creating a skill file from scratch and extending the memory API.

Prompt 1: Create a Security Auditor Skill File#

When#

Stage 1 (~minute 10) — after walking through the skill system and SkillParser

Context#

File open: skills/samples/dotnet-expert.md (as a reference for the format)
What just happened: We explained YAML frontmatter, SkillDefinition, FileSkillLoader, and how skills get injected into the system prompt

Mode#

Copilot Chat (sidebar)

Exact Prompt#

Create a new skill file called security-auditor.md for the OpenClawNet skill system. It should follow the same YAML frontmatter format as dotnet-expert.md. The skill should instruct the agent to act as a security auditor — reviewing code for vulnerabilities, suggesting OWASP best practices, checking for common .NET security issues like SQL injection, XSS, path traversal, and insecure deserialization. Include tags for security, audit, owasp, and dotnet. Set enabled to true.

Expected Result#

A complete Markdown file with valid YAML frontmatter:

---
name: security-auditor
description: Security auditing expertise for .NET applications
tags: [security, audit, owasp, dotnet]
enabled: true
---
 
You are a security auditor assistant. When reviewing code or answering questions:
 
- Identify common vulnerabilities (OWASP Top 10)
- Check for .NET-specific security issues:
  - SQL injection via string concatenation
  - XSS in Razor views and API responses
  - Path traversal in file operations
  - Insecure deserialization
- Recommend secure coding patterns and mitigations
- Reference OWASP guidelines and Microsoft security documentation
- Prioritize findings by severity (Critical, High, Medium, Low)

Why It's Interesting#

No C# required — Copilot generates a complete skill using just Markdown
Format awareness — it follows the YAML frontmatter convention from the existing skill
Immediately testable — save the file, reload skills, and ask a security question
Demonstrates skill extensibility — anyone (even non-developers) can create skills for the agent

How to Test#

# Save the file to skills/samples/security-auditor.md
# Then reload and verify:
curl -X POST http://localhost:5000/api/skills/reload
curl http://localhost:5000/api/skills | jq '.[] | select(.name == "security-auditor")'

Prompt 2: Add Search-by-Date Filter to MemoryEndpoints#