## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - Hiring agents is a governance-sensitive workflow because it grants roles, adapter config, skills, and execution capability > - The create-agent skill needs explicit templates and review guidance so hires are auditable and not over-permissioned > - Skill sync also needs to recognize bundled Paperclip skills consistently for Codex local agents > - This pull request expands create-agent role templates, adds a security-engineer template, and documents capability/secret-handling review requirements > - The benefit is safer, more repeatable agent creation with clearer approval payloads and less permission sprawl ## What Changed - Expanded `paperclip-create-agent` guidance for template selection, adjacent-template drafting, and role-specific review bars. - Added a Security Engineer agent template and collaboration/safety sections for Coder, QA, and UX Designer templates. - Hardened draft-review guidance around desired skills, external-system access, secrets, and confidential advisory handling. - Updated LLM agent-configuration guidance to point hiring workflows at the create-agent skill. - Added tests for bundled skill sync, create-agent skill injection, hire approval payloads, and LLM route guidance. ## Verification - `pnpm exec vitest run server/src/__tests__/agent-skills-routes.test.ts server/src/__tests__/codex-local-skill-injection.test.ts server/src/__tests__/codex-local-skill-sync.test.ts server/src/__tests__/llms-routes.test.ts server/src/__tests__/paperclip-skill-utils.test.ts --config server/vitest.config.ts` passed: 5 files, 23 tests. - `git diff --check public-gh/master..pap-2228-create-agent-governance -- . ':(exclude)ui/storybook-static'` passed. - Confirmed this PR does not include `pnpm-lock.yaml`. ## Risks - Low-to-medium risk: this primarily changes skills/docs and tests, but it affects future hiring guidance and approval expectations. - Reviewers should check whether the new Security Engineer template is too broad for default company installs. - No database migrations. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex coding agent based on GPT-5, with shell, git, Paperclip API, and GitHub CLI tool use in the local Paperclip workspace. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge Note: screenshot checklist item is not applicable; this PR changes skills, docs, and server tests. --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
7.2 KiB
name, description
| name | description |
|---|---|
| paperclip-create-agent | Create new agents in Paperclip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hire request. |
Paperclip Create Agent Skill
Use this skill when you are asked to hire/create an agent.
Preconditions
You need either:
- board access, or
- agent permission
can_create_agents=truein your company
If you do not have this permission, escalate to your CEO or board.
Workflow
1. Confirm identity and company context
curl -sS "$PAPERCLIP_API_URL/api/agents/me" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
2. Discover adapter configuration for this Paperclip instance
curl -sS "$PAPERCLIP_API_URL/llms/agent-configuration.txt" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
# Then the specific adapter you plan to use, e.g. claude_local:
curl -sS "$PAPERCLIP_API_URL/llms/agent-configuration/claude_local.txt" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
3. Compare existing agent configurations
curl -sS "$PAPERCLIP_API_URL/api/companies/$PAPERCLIP_COMPANY_ID/agent-configurations" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
Note naming, icon, reporting-line, and adapter conventions the company already follows.
4. Choose the instruction source (required)
This is the single most important decision for hire quality. Pick exactly one path:
- Exact template — the role matches an entry in the template index. Use the matching file under
references/agents/as the starting point. - Adjacent template — no exact match, but an existing template is close (for example, a "Backend Engineer" hire adapted from
coder.md, or a "Content Designer" adapted fromuxdesigner.md). Copy the closest template and adapt deliberately: rename the role, rewrite the role charter, swap domain lenses, and remove sections that do not fit. - Generic fallback — no template is close. Use the baseline role guide to construct a new
AGENTS.mdfrom scratch, filling in each recommended section for the specific role.
Template index and when-to-use guidance:
skills/paperclip-create-agent/references/agent-instruction-templates.md
Generic fallback for no-template hires:
skills/paperclip-create-agent/references/baseline-role-guide.md
State which path you took in your hire-request comment so the board can see the reasoning.
5. Discover allowed agent icons
curl -sS "$PAPERCLIP_API_URL/llms/agent-icons.txt" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
6. Draft the new hire config
- role / title / name
- icon (required in practice; pick from
/llms/agent-icons.txt) - reporting line (
reportsTo) - adapter type
desiredSkillsfrom the company skill library when this role needs installed skills on day one- if any
desiredSkillsor adapter settings expand browser access, external-system reach, filesystem scope, or secret-handling capability, justify each one in the hire comment - adapter and runtime config aligned to this environment
- leave timer heartbeats off by default; only set
runtimeConfig.heartbeat.enabled=truewith anintervalSecwhen the role genuinely needs scheduled recurring work or the user explicitly asked for it - if the role may handle private advisories or sensitive disclosures, confirm a confidential workflow exists first (dedicated skill or documented manual process)
- capabilities
- run prompt in adapter config (
promptTemplatewhere applicable) - for coding or execution agents, include the Paperclip execution contract: start actionable work in the same heartbeat; do not stop at a plan unless planning was requested; leave durable progress with a clear next action; use child issues for long or parallel delegated work instead of polling; mark blocked work with owner/action; respect budget, pause/cancel, approval gates, and company boundaries
- instruction text such as
AGENTS.mdbuilt from step 4; for local managed-bundle adapters, put the adaptedAGENTS.mdcontent inadapterConfig.promptTemplateunless you are a board user intentionally managing bundle paths/files - source issue linkage (
sourceIssueIdorsourceIssueIds) when this hire came from an issue
7. Review the draft against the quality checklist
Before submitting, walk the draft-review checklist end-to-end and fix any item that does not pass:
skills/paperclip-create-agent/references/draft-review-checklist.md
8. Submit hire request
curl -sS -X POST "$PAPERCLIP_API_URL/api/companies/$PAPERCLIP_COMPANY_ID/agent-hires" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "CTO",
"role": "cto",
"title": "Chief Technology Officer",
"icon": "crown",
"reportsTo": "<ceo-agent-id>",
"capabilities": "Owns technical roadmap, architecture, staffing, execution",
"desiredSkills": ["vercel-labs/agent-browser/agent-browser"],
"adapterType": "codex_local",
"adapterConfig": {"cwd": "/abs/path/to/repo", "model": "o4-mini"},
"runtimeConfig": {"heartbeat": {"enabled": false, "wakeOnDemand": true}},
"sourceIssueId": "<issue-id>"
}'
9. Handle governance state
- if the response has
approval, the hire ispending_approval - monitor and discuss on the approval thread
- when the board approves, you will be woken with
PAPERCLIP_APPROVAL_ID; read linked issues and close/comment follow-up
curl -sS "$PAPERCLIP_API_URL/api/approvals/<approval-id>" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
curl -sS -X POST "$PAPERCLIP_API_URL/api/approvals/<approval-id>/comments" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
-H "Content-Type: application/json" \
-d '{"body":"## CTO hire request submitted\n\n- Approval: [<approval-id>](/approvals/<approval-id>)\n- Pending agent: [<agent-ref>](/agents/<agent-url-key-or-id>)\n- Source issue: [<issue-ref>](/issues/<issue-identifier-or-id>)\n\nUpdated prompt and adapter config per board feedback."}'
If the approval already exists and needs manual linking to the issue:
curl -sS -X POST "$PAPERCLIP_API_URL/api/issues/<issue-id>/approvals" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
-H "Content-Type: application/json" \
-d '{"approvalId":"<approval-id>"}'
After approval is granted, run this follow-up loop:
curl -sS "$PAPERCLIP_API_URL/api/approvals/$PAPERCLIP_APPROVAL_ID" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
curl -sS "$PAPERCLIP_API_URL/api/approvals/$PAPERCLIP_APPROVAL_ID/issues" \
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
For each linked issue, either:
- close it if the approval resolved the request, or
- comment in markdown with links to the approval and next actions.
References
- Template index and how to apply a template:
skills/paperclip-create-agent/references/agent-instruction-templates.md - Individual role templates:
skills/paperclip-create-agent/references/agents/ - Generic baseline role guide (no-template fallback):
skills/paperclip-create-agent/references/baseline-role-guide.md - Pre-submit draft-review checklist:
skills/paperclip-create-agent/references/draft-review-checklist.md - Endpoint payload shapes and full examples:
skills/paperclip-create-agent/references/api-reference.md