Free OpenClaw Skill for Vape and CBD Stores: Age-Gate, COA, Compliance Agent (Download)

What this skill does for your vape and CBD stores

• Maintains the certificate-of-analysis library by SKU and batch, drafts the customer-facing COA link reply for every product inquiry within 2 minutes.
• Tracks the state-by-state legality matrix for Delta-8, Delta-10, HHC, THCa, THCP, and the 2018 Farm Bill hemp definition; blocks shipments to states where a SKU is restricted.
• Runs the age verification cadence (Veratad, AgeChecker.net, Yoti) on every online order, escalates failed verifications to the owner before the order ships.
• Drafts the weekly PMTA-status check for nicotine SKUs: which products are on the FDA's market-status list, which are in pending review, which are subject to marketing denial orders.
• Routes every customer message that touches age verification, refund on opened product, or a regulatory question to a human; flips routine inventory and inquiry traffic to autonomous after validation.

What's inside this OpenClaw skill

The full file you download, indexed below for search engines and for operators who want to read before they install.

---
name: vape-cbd-compliance
description: Compliance and customer operations for vape and CBD stores. Age verification, certificate-of-analysis library, state-by-state Delta-8 legality, FDA PMTA awareness. Integrates with KORONA, LightSpeed Retail, Shopify, Veratad, AgeChecker.net, Yoti.
version: 1.0.0
author: OpenClaw Consult (Adhiraj Hangal)
license: MIT
url: https://openclawconsult.com/skills/vape-cbd-stores
---

# OpenClaw Skill: Vape and CBD Compliance and Customer Operations

## Overview

This skill turns the OpenClaw agent into the operational compliance and
customer-ops layer for a vape or CBD store. It owns age verification handling,
the certificate-of-analysis library, the state-by-state Delta-8 / Delta-10 /
HHC / THCa legality matrix, the FDA PMTA status tracker for nicotine SKUs,
and the routine customer inquiry response.

Designed for single-location and small-chain vape and CBD retail running
KORONA, LightSpeed Retail, or Shopify, with high-risk payment processing
through Authorize.net / Easy Pay Direct, NMI, or USAePay.

This skill is operational support. It does not replace a compliance attorney
and it does not file PMTAs.

## What this skill does

1. Maintains the SKU and batch COA library, drafts COA-link replies on inquiry
2. Tracks the state-by-state Delta-8 / Delta-10 / HHC / THCa / THCP legality matrix
3. Runs the age verification cadence (Veratad, AgeChecker.net, Yoti) and escalates failures
4. Maintains the FDA PMTA status tracker (granted, pending, MDO) per nicotine SKU
5. Blocks shipments to states where a SKU is restricted
6. Drafts customer order, inquiry, and refund replies for owner approval

## Triggers

```yaml
triggers:
  - type: heartbeat
    schedule: "0 7 * * *"           # Daily 7am
    action: morning_compliance_and_order_review

  - type: heartbeat
    schedule: "0 17 * * 1"          # Mondays 5pm
    action: refresh_pmta_status_list

  - type: on_event
    event: pos.online_order_placed
    action: run_age_verification_and_state_check

  - type: on_event
    event: age_verification.failed
    action: hold_order_and_escalate_to_owner

  - type: on_event
    event: pos.new_batch_received
    action: ingest_coa_into_library

  - type: on_event
    event: helpdesk.coa_inquiry_received
    action: draft_coa_reply
```

## Workflow: age verification and shipping block

Every online order triggers:

1. Run age verification through Veratad / AgeChecker.net / Yoti against the customer's name and DOB
2. If first-pass clears, proceed to the state-legality check
3. If first-pass fails, escalate to the owner with an ID-upload request to the customer
4. State-legality check: cross-reference the cart contents against the destination state in the legality matrix
5. If any SKU is restricted in the destination state, block the order line and notify the customer with the refund script for that line
6. Pass the cleared order through to fulfillment

Default escalations to the owner: age verification failure, address mismatch,
high-value order over a configurable threshold ($300 default), any order to a
state with pending legislation on the cart contents.

## Workflow: COA library

When new inventory arrives, the skill:

1. Ingests the COA PDF into Google Drive or S3 with a structured filename: `{sku}_{batch}_{vendor}_{date}.pdf`
2. Extracts key results: cannabinoid potency profile, pesticide pass / fail, heavy metal pass / fail, mycotoxin pass / fail, residual solvent pass / fail
3. Indexes the SKU to the batch COA in memory
4. When a customer asks for the COA on a product, replies within 2 minutes with the direct link plus the key result summary

Modern customers ask for COAs by default. Slow COA replies kill conversion.
The skill drives the typical reply time from 4 to 12 hours down to under 2
minutes.

## Workflow: state legality matrix

The skill ships a legality matrix for hemp-derived cannabinoids that the owner
revalidates quarterly. As of the file version date:

```yaml
state_legality_matrix:
  delta_8:
    illegal: [AK, AZ, AR, CO, CT, DE, ID, IA, MD, MS, MT, NV, NY, ND, OR, RI, SC, UT, VT, WA]
    restricted: [LA, MI, OH, TN]
    legal: [most other states]

  delta_10:
    illegal: [AK, AZ, AR, CO, CT, DE, ID, IA, MD, MS, MT, NV, NY, OR, RI, UT, VT, WA]
    legal: [most other states]

  thca:
    illegal: [AK, AR, CO, DE, HI, ID, OR, RI, UT]
    restricted_total_thc_cap: [CT, FL, KY, LA, MN, NC]
    legal_under_farm_bill_interpretation: [most other states]

  hhc:
    illegal: [AK, AZ, AR, CO, DE, ID, LA, MA, MN, MS, NV, NY, OR, RI, UT, VA, VT, WA]
    legal: [most other states]
```

Owner revalidates against current state AG opinions and pending legislation
each quarter. This is a moving target.

## Workflow: PMTA status tracker

For nicotine SKUs, the skill maintains:

```yaml
pmta_status:
  market_granted_order:
    description: FDA has granted authorization for sale
    action: continue_selling

  pending_review:
    description: PMTA application is pending FDA review
    action: continue_selling_with_quarterly_check

  marketing_denial_order:
    description: FDA has denied authorization
    action: stop_orders_immediately_sell_through_existing_stock

  no_application_filed:
    description: Product has no PMTA on file
    action: high_legal_risk_flag_to_owner
```

The skill refreshes the SKU-to-status map against the FDA's published list
weekly. MDO additions trigger an immediate owner alert with the affected SKUs
and current inventory levels.

## Memory keys

```yaml
memory:
  - key: vape.coa_library[{sku_id}]
    description: Latest COA per SKU
    schema: { batch_id: string, drive_link: string, potency: object, pesticide_pass: bool, heavy_metals_pass: bool, mycotoxin_pass: bool, residual_solvent_pass: bool, indexed_at: datetime }

  - key: vape.age_verification[{order_id}]
    description: Verification result for the order
    schema: { provider: string, result: enum, escalated_to_owner: bool, owner_resolution: string }

  - key: vape.state_block[{order_id}]
    description: State-legality block log
    schema: { skus_blocked: array, state: string, reason: string, customer_notified: bool }

  - key: vape.pmta_status[{sku_id}]
    description: Current FDA PMTA status per nicotine SKU
    values: [granted, pending, denied, no_application, supplemental]
```

## Message templates

```yaml
templates:
  coa_inquiry_reply:
    channel: email
    body: |
      Hi {customer_first_name},

      Here is the COA for the {product_name} you asked about:

      {coa_link}

      Key results from batch {batch_id}:
      - Cannabinoid potency: {potency_summary}
      - Pesticide: {pesticide_result}
      - Heavy metals: {heavy_metals_result}
      - Mycotoxin: {mycotoxin_result}
      - Residual solvent: {residual_solvent_result}

      Reach back if you need anything else.

      {brand_name}

  age_verification_failure_to_customer:
    channel: email
    body: |
      Hi {customer_first_name},

      We need a quick ID verification step before your {order_number} order
      can ship. Our compliance system flagged the verification on the first
      pass, which usually just means the name or DOB needed a closer look.

      Please reply with a clear photo of the front of a valid government ID.
      We delete it after verification.

      Order will hold for 72 hours pending your reply.

      {brand_name} Compliance

  state_legality_block_to_customer:
    channel: email
    body: |
      Hi {customer_first_name},

      Unfortunately we cannot ship {blocked_skus} to {destination_state}.
      Current state regulations restrict the sale of these products in your
      state. We have refunded that line and shipped the remainder of your
      order (refund: {refund_amount}, remaining ship total: {remaining_total}).

      We will keep an eye on legislation in {destination_state} and let you
      know if anything changes.

      {brand_name}

  mdo_inventory_owner_alert:
    channel: slack
    body: |
      FDA MDO ALERT
      The following SKUs were added to the FDA marketing denial order list
      this week:
      {affected_skus}
      Current inventory: {current_units}
      Suggested action: stop online orders for these SKUs immediately, sell
      through in-store stock per your compliance counsel's guidance.
```

## Required integrations

| Integration                  | Purpose                                  | Read | Write |
|------------------------------|------------------------------------------|------|-------|
| KORONA POS                   | Inventory and order data                 | yes  | optional |
| LightSpeed Retail            | Inventory and order data                 | yes  | optional |
| Shopify Admin GraphQL        | Online order and customer data           | yes  | optional |
| Veratad / AgeChecker.net / Yoti | Age verification API                  | yes  | yes   |
| Google Drive or S3           | COA PDF storage                          | yes  | yes   |
| FDA PMTA published list      | Status reference (web fetch)             | yes  | no    |
| High-risk payment processor  | Auth.net, NMI, USAePay webhook events    | yes  | no    |
| OpenClaw Memory              | Cross-run state                          | yes  | yes   |
| OpenClaw Heartbeat           | Scheduled compliance refresh             | yes  | yes   |

Write-back to the POS starts disabled. The skill drafts; the owner commits.

## Compliance notes

This skill is operational support. It is not legal counsel. Hemp-derived
cannabinoid law changes weekly. PMTA status changes monthly. Age verification
provider terms change quarterly. Pair this skill with a compliance attorney
and revalidate the state legality matrix quarterly.

The skill does not store customer ID images in OpenClaw memory. Age verification
provider holds the documentation according to their data-retention policy.
Owner is responsible for confirming the data-retention terms of the chosen
provider.

## Configuration

```yaml
config:
  brand_name: "Your Shop Name"
  pos_system: korona              # or "lightspeed_retail", "shopify"
  age_verification_provider: veratad   # or "agechecker", "yoti"
  coa_storage: google_drive       # or "s3", "dropbox"
  high_risk_processor: easy_pay_direct  # or "nmi", "usaepay", "authorize_net_direct"
  state_legality_revalidation_due_date: "2026-08-14"
  pmta_refresh_cadence: weekly
  approval_mode: owner_approves_all     # or "autonomous_after_2_weeks"
  autonomous_template_allowlist:
    - coa_inquiry_reply
  high_value_order_escalation_threshold_usd: 300
```

## Quick install

```bash
mkdir -p ~/.claude/skills
mv vape-cbd-stores.md ~/.claude/skills/vape-cbd-compliance.md
# Edit the config block to match your shop
```

Launch OpenClaw and the skill is live. Trigger it manually with `run morning compliance review`
or wait for Heartbeat to fire on the configured schedule.

## Want it wired to your stack?

The free SKILL.md is the starting point. If you want this plugged into your
specific POS, your specific age verification provider, your COA storage,
your high-risk processor, and the state legality posture you actually operate
under, OpenClaw Consult ships a fixed-price 14-day build with the founder
writing every line.
https://www.adhirajhangal.com/work

Install in 60 seconds

1. 1

   Drop the file into your OpenClaw skills directory

   Save the downloaded vape-cbd-stores.md as ~/.claude/skills/vape-cbd-compliance.md. OpenClaw picks up new skill files on next agent launch. If you operate multiple storefronts, scope it per location with the project-level .claude/skills/ folder.

2. 2

   Connect your POS, age verification, and COA storage

   Edit the integrations block to point at your KORONA, LightSpeed Retail, or Shopify export, plus your Veratad, AgeChecker.net, or Yoti API key, plus the Google Drive or S3 bucket where you store COAs. Read-only is enough to start.

3. 3

   Launch in owner-approval mode, validate, then go autonomous on routine traffic

   Start with the owner approving every age-verification escalation, every COA reply, and every shipping-block decision for two weeks. After validation, flip routine COA replies and order-status questions to autonomous. Age failures, refunds on opened product, and any state-legality question always stay with a human.

Example conversation

Common questions

Related free skills