Ready-to-run application examples for your NemoClaw sandbox — policy, prompt, and personalization for each workflow
This is a cron-style workflow: the agent wakes up on a schedule, fetches updates from a small allowlist of URLs, summarizes them, and posts a digest to your Telegram home channel.
Start from the NemoClaw Policy Setup tab's working Telegram channel (channel plugin + api.telegram.org egress). Then add network egress for the sources you want the agent to read by applying a small custom preset with nemoclaw policy-add --from-file. The preset is additive and hot-reloads — you do not need to dump or round-trip the full live policy.
Create news-sources.yaml:
preset:
name: news-sources
description: "Daily news digest source allowlist"
network_policies:
news-sources:
name: news-sources
endpoints:
- host: developer.nvidia.com
port: 443
access: full
tls: skip
- host: blogs.nvidia.com
port: 443
access: full
tls: skip
- host: news.ycombinator.com
port: 443
access: full
tls: skip
binaries:
- { path: /usr/local/bin/openclaw }
- { path: /usr/local/bin/node }
- { path: /usr/bin/node }
- { path: /usr/bin/curl }
network_policies is a map keyed by group name (here, news-sources); each group has its own name and an endpoints list. A bare list of {host, port} records directly under network_policies will fail with invalid type: sequence, expected a map.
IMPORTANT
Both preset.name and the network_policies group key must be lowercase, hyphenated RFC 1123 labels (letters, digits, and hyphens only — no underscores). Using news_sources fails with Preset must declare preset.name (lowercase, hyphenated RFC 1123 label). This matches the shipped presets (brave, github, slack), which all use hyphenated names.
IMPORTANT
Each endpoint needs two things beyond host/port, or the egress proxy denies the connection with curl: (56) CONNECT tunnel failed, response 403 even though the host shows up in the live policy:
access: full with tls: skip (the same shape the shipped whatsapp/brew presets use). The alternative is an L7-filtered protocol: rest + enforcement: enforce + rules block, but that requires the proxy to terminate TLS and is unnecessary for read-only news fetches.binaries allow-list naming which programs may use this egress. The agent's web fetcher runs under /usr/local/bin/openclaw and node; include /usr/bin/curl so shell-based fetches work too. Without a binaries clause no binary is authorized to open the tunnel, so every fetch returns 403.A bare {host, port} entry (no access mode, no binaries) is the single most common reason the digest "applies cleanly" but then can't read anything.
Apply the preset (hot-reload, no sandbox restart):
nemoclaw $SANDBOX_NAME policy-add --from-file ./news-sources.yaml --yes
Confirm the new hosts are present:
openshell policy get $SANDBOX_NAME --full | grep -E "host:|port:"
TIP
Prefer nemoclaw policy-add --from-file over openshell policy get --full > policy.yaml followed by openshell policy set. The full-dump round trip in openshell 0.0.44 emits Version: (capital V) while the parser expects version: (lowercase), so policy set rejects its own output with unknown field 'Version'. The additive policy-add flow never touches the live version: field and avoids the bug. If you hit that error from an older recipe, lowercase the key in place — sed -i 's/^Version:/version:/' policy.yaml — and rerun policy set.
Copy the full prompt below and paste it into the NemoClaw web UI (or send it as a single Telegram message to your bot). This is the canonical prompt — it defines the agent's complete behavior end-to-end, and no other configuration is required. It walks the agent through a one-time onboarding, a fixed briefing structure, style rules, error handling, and recurring schedule maintenance — so it works for a regular consumer who just wants to wake up informed, not buried.
You are my personal news intelligence analyst. Your job is to make sure I wake
up each morning already knowing the few things that matter — and never to
bury me in noise.
ONE-TIME SETUP (do this on your very first run only, then remember my answers
as my profile):
Ask me, one question at a time, and wait for my answer before moving on:
1. What's on your news menu? Pick any combination of: world news,
US politics, business, personal finance, technology, climate,
science, health, sports, entertainment, lifestyle. You can also
name your own custom beats — anything from "Formula 1" to "indie
video games" to "my hometown city council" counts.
2. Who should I sound like when I write to you? Pick one:
- Plain-language explainer (no jargon, ever)
- Neutral wire-service (just the facts, AP-style)
- Friendly newsletter (warm, a little chatty)
- Executive briefing (tight, bullet-heavy, no filler)
3. How much time do you give me with your coffee? 60-second skim,
3-minute read, or 10-minute deep brief — pick one and we can
change it any time.
4. Any VIPs or villains? Tell me the people, companies, teams, or
topics I should always surface for you — and anything I should
never put in your briefing.
5. Where are you waking up? Give me a city (or country) so the
weather and the "near you" news are actually near you.
6. When's showtime? Default is 08:00 America/Los_Angeles every
weekday. Tell me if you want a different time, timezone, or
cadence (daily, weekdays only, weekend recap, etc.).
Confirm my answers back to me in a short summary, then run the first
briefing immediately so I can see what to expect.
DAILY BRIEFING STRUCTURE (use this exact shape every run, in this order):
1. Top 3 — the three stories I cannot miss today. One sentence each,
followed by a one-clause "why it matters to me" tailored to my profile.
2. Headlines by topic — under each topic I follow, 3 to 5 bullet
headlines with the source name in parentheses and the URL.
3. Deep dive — pick the single most important story of the day and
explain it in 4 to 6 short sentences: what happened, why now, who
is affected, what to watch next.
4. Skip the noise — one or two lines naming stories that are loud
today but safe for me to ignore, with a brief reason.
5. On my radar — events, earnings, votes, sports fixtures, or
deadlines in the next 7 days that match my profile.
6. Local — a 2-sentence weather summary plus any notable local news
for the city I chose.
STYLE RULES:
- Plain language; assume I am not an expert in any topic.
- No hype words ("shocking", "you won't believe", "breaking"). Just
the facts.
- Cite every claim with the source name and a working URL.
- Never invent quotes, numbers, dates, or events. If you cannot
verify a detail, omit it or label it clearly as "unconfirmed".
- Deduplicate: if multiple sources report the same story, pick the
most credible one and link only that.
- Respect my length preference. If it's tight, drop sections rather
than shortening each one to the point of being useless.
ERROR HANDLING:
- If a source is unreachable, add it to a short "Sources skipped
today" line at the bottom with the reason, and keep going.
- If the news is genuinely quiet on a topic, write "Quiet day —
nothing material" instead of padding with filler.
- If two days in a row have nothing in a topic, ask me once whether
I want to drop it from my profile.
SCHEDULE AND DELIVERY:
- Register this as a recurring task in your built-in scheduler at the
time and timezone I picked. Confirm the next 3 trigger times back
to me after onboarding.
- Deliver each briefing to my Telegram home channel.
- Skip US public holidays unless a major breaking story is unfolding.
WEEKLY CHECK-IN:
- On Friday's briefing only, end with one line: "Want me to adjust
your topics, length, sources, or delivery time?" If I reply, update
my profile and confirm the change.
Start now: ask me the setup questions, save my profile, then run
today's first briefing.
Expected: the agent confirms it has scheduled a task. On the next 08:00 trigger you receive a digest message in your Telegram home channel. You can ask Show me my scheduled tasks in the web UI to verify it was registered.
Depending on the model you choose, it can take some time to set up the agent workflow. If at any point the agent is not progressing, ask Is my workflow set up yet in the web UI to wake up the agent.
NOTE
Running without Telegram (web-UI delivery). If you have not configured a Telegram channel, replace the delivery line in the prompt — Deliver each briefing to my Telegram home channel. — with Deliver each briefing to the web UI (this session). Do not use any messaging channel. The agent then writes each briefing back into the session you can read in the dashboard. Tell the agent your delivery choice when you answer onboarding question 6. (See also the Delivery channel row in Step 3.)
TIP
Test the schedule end-to-end by asking the agent to run the digest once now before the first scheduled trigger fires: "Run the digest task now as a one-off, then keep the schedule for tomorrow." This one-off runs through the live agent and is the most reliable end-to-end check (it produces a real briefing immediately).
IMPORTANT
Register the schedule from the operator side — don't rely on the agent's tool call. When the agent runs as an embedded openclaw agent turn (the headless path used here), its in-turn cron tool connects to the gateway with a device token that lacks the scheduler scope, so the registration is rejected with scope upgrade pending approval … pairing required: device is asking for more scopes than currently approved. The agent then reports it "has no built-in scheduler" or that the scheduler is "flapping." Register the recurring job yourself instead — this is verified to work:
nemoclaw $SANDBOX_NAME exec -- openclaw cron add \
--name news-digest --cron "0 8 * * 1-5" --tz America/Los_Angeles \
--agent default --session-key agent:default:news-digest \
--message "Run my daily news briefing now and write it to this session." \
--no-deliver --token ""
--no-deliver keeps the briefing in the session (read it in the web UI) instead of pushing to a chat channel — required when no Telegram/Slack channel is configured, otherwise the run fails-closed with last -> no route. Confirm with nemoclaw $SANDBOX_NAME exec -- openclaw cron list and ... openclaw cron status. (When you paste the prompt into the interactive web UI rather than running headless, the dashboard prompts you to approve the scope and the agent can register the job itself; the operator command above is the reliable path either way.)
IMPORTANT
Scheduled triggers on a local model (vLLM). Once registered, scheduled cron runs are gated by a provider pre-flight check that does a plain DNS lookup of the managed-inference host inference.local. That host only resolves through the egress proxy (it has no real DNS / /etc/hosts record), so the pre-flight fails with getaddrinfo EAI_AGAIN inference.local and the run is logged as skipped. Live openclaw agent turns (onboarding, the "run once now" one-off above, anything you type in the web UI) are unaffected — they reach the model fine through the proxy. If you need unattended scheduled delivery on a local model, point the cron job at a DNS-resolvable inference endpoint instead of inference.local (the local-inference preset already allows the host's vLLM at host.openshell.internal:8000, which resolves via /etc/hosts); pass it to cron add with --model. Cloud-model sandboxes (whose provider host resolves normally) are not affected.
| Knob | Where | What to change |
|---|---|---|
| Schedule | openclaw cron add (operator command in Step 2) | Change the --cron "0 8 * * 1-5" expression and --tz in the registration command (0 9 * * 1 = Mondays 09:00, 0 */6 * * * = every 6 hours, etc.). Keep the prompt's stated time in sync so the agent's "next 3 trigger times" line matches. |
| Sources | news-sources.yaml and the prompt | Add the host as a new entry under network_policies.news-sources.endpoints, rerun nemoclaw $SANDBOX_NAME policy-add --from-file ./news-sources.yaml --yes, then list the URL in the prompt. The sandbox blocks any fetch to a host that is not in the allowlist. |
| Voice | Prompt — onboarding Q2 | Replace any of the four voice options (Plain-language explainer, Neutral wire-service, Friendly newsletter, Executive briefing) with your own (e.g., Calm dad voice, Skeptical analyst, Snarky finance bro). |
| Length | Prompt — onboarding Q3 | Replace the three length options (60-second skim, 3-minute read, 10-minute deep brief) with what suits your morning (5-minute read, quick scan over breakfast, etc.). |
| Delivery channel | Prompt | Replace Telegram home channel with the web UI if you'd rather read it on the dashboard, or with another configured channel. |
| Filtering | Prompt | Add Only include posts that mention "Spark" or "GB10". to focus the digest. |
To cancel the scheduled task later, send: List my scheduled tasks, then cancel the digest one.