)
Last updated: November 5, 2026
What are OpenClaw skills? OpenClaw skills are folders of markdown instructions, each built around a SKILL.md file, that teach the OpenClaw agent how and when to use its tools. You install them from ClawHub, the public registry, or write your own. Because a skill runs with the agent's own authority, choosing one is a security decision as much as a feature choice.
TL;DR: Key Takeaways
- OpenClaw loads skills across 7 priority levels, and a workspace skill beats a bundled skill with the same name (OpenClaw docs).
- One command installs a ClawHub skill,
openclaw skills install @owner/<slug>, andopenclaw skills verifychecks its trust envelope (OpenClaw CLI docs). - The OpenClaw repository lists 50 bundled skill folders, so start there before adding community skills (OpenClaw on GitHub).
- Koi Security audited 2,857 ClawHub skills in February 2026 and found 341 malicious ones (The Hacker News, 2026).
- Five more malicious skills reported on June 23, 2026 had passed ClawHub's automated scanning (Cloud Security Alliance, 2026).
- ClawHub shows 1 of 6 audit statuses per release, and its docs say a Pass is not a guarantee (ClawHub docs).
At a glance: what to know before you install a skill
Quick Answer
How do you use OpenClaw skills safely?
Install skills from ClawHub with openclaw skills install @owner/<slug>. Read the SKILL.md and the security audit first, and give each agent only the skills it needs through an allowlist. Run OpenClaw in a sandbox. Treat every third-party skill as untrusted code, because it runs with the agent's authority.
| Topic | What to know |
|---|---|
| Format | A folder with a SKILL.md file: YAML frontmatter plus markdown instructions |
| Registry | ClawHub, with versions, tags, downloads, stars and security scan summaries |
| Install | openclaw skills install @owner/<slug>, or from Git, a local folder or skills.sh |
| Trust signal | Audit status (Pass, Review, Warn, Malicious, Pending, Error) and risk level |
| Biggest risk | Supply chain: malicious skills that pass scanners and run with the agent's access |
How we researched
On November 5, 2026 we read the OpenClaw documentation for skills, ClawHub, the CLI and security audits, listed the repository's bundled skills and read the 2026 ClawHub security research. The selection criteria and checklist are our synthesis.
What are OpenClaw skills, and how do they differ from plugins and MCP?
OpenClaw skills are markdown instruction files that teach the agent how and when to use tools. Each skill lives in its own directory with a SKILL.md file that has YAML frontmatter and a markdown body. They differ from plugins, which add code, and from MCP servers, which expose tools the agent can call.
| Concept | What it is | What it changes | Typical source |
|---|---|---|---|
| Skill | Markdown instructions plus optional scripts and files | How the agent uses tools it already has | ClawHub, Git, local folder |
| Plugin | Code package with compatibility metadata | What OpenClaw can do (channels, tools, hubs) | ClawHub, npm |
| MCP server | A service that exposes tools over the Model Context Protocol | Which external tools the agent can call | Vendor or self-hosted |
| Tool | A callable function such as shell or browser | The agent's raw capabilities | Built in or provided by plugins |
A skill can still do a lot of damage. It tells the agent which tools to call and what to run, so a malicious skill borrows the agent's shell, files and logged-in sessions. Plugins can also ship their own skills, and OpenClaw follows the AgentSkills specification, which is why the same idea appears in our guides to Claude Code skills and ChatGPT skills.
From Clawdbot to OpenClaw: where the project stands
According to Wikipedia (2026), the project started in November 2025 as Warelay and was renamed Clawdbot, then Moltbot on January 27, 2026 and OpenClaw three days later. On February 14, 2026, creator Peter Steinberger announced he was joining OpenAI and that a non-profit OpenClaw Foundation would steward the project. The stable 2.0 release is v2026.8.1.
Old tutorials still use the Clawdbot name. A guide that mentions metadata.clawdbot or a .clawdhub folder predates July 2026. Our guide to OpenClaw alternatives covers why teams switch, and the Moltbook story covers the agent network behind the hype.
)
How a skill works: SKILL.md, gating and loading order
A skill is a folder with a SKILL.md file. OpenClaw reads the frontmatter, checks whether the skill is eligible on the current machine, and adds eligible skills to the agent's prompt as a compact catalog. The agent reads the full instructions only when a task needs them. Eligibility depends on binaries, environment variables, config and operating system.
Anatomy of a SKILL.md
Every skill needs a name and a description. The docs advise a lowercase name with digits and hyphens, and a one-line description under 160 characters. Optional metadata.openclaw keys decide whether the skill is ready to run:
| Gating key | What OpenClaw checks |
|---|---|
requires.bins | Every listed binary exists on PATH |
requires.anyBins | At least one listed binary exists on PATH |
requires.env | Each environment variable is set or provided through config |
requires.config | Each listed openclaw.json path is truthy |
os | The host or a connected runtime matches a listed platform |
always | Include the skill whenever the OS matches, skipping the other checks |
If a skill is installed but the agent does not use it, openclaw skills check separates inventory, readiness and visibility and names the missing prerequisite.
Where OpenClaw looks for skills
When the same skill name appears in several places, the highest-precedence source wins. OpenClaw finds a skill wherever a SKILL.md appears under a configured root, up to 6 levels deep, and the folder path is only for organization.
| Priority | Source | Path |
|---|---|---|
| 1 (highest) | Workspace skills | <workspace>/skills |
| 2 | Project agent skills | <workspace>/.agents/skills |
| 3 | Personal agent skills | ~/.agents/skills |
| 4 | Managed or local skills | <state-dir>/skills |
| 5 | Workshop skills | <state-dir>/agents/<agentId>/agent/workshop-skills |
| 6 | Bundled skills | Shipped with the install |
| 7 (lowest) | Extra directories and plugin skills | skills.load.extraDirs |
How the agent finds and calls a skill
The prompt carries a bounded catalog of eligible skills. Since v2026.10.1, skills left out of that catalog stay discoverable through skills_search, and the agent loads a full SKILL.md with skills_read. Searching does not install anything or grant permission to run a skill's commands.
You can also call skills yourself. Type $ in the Control UI composer to pick one, or reference up to eight skills in a single message, such as Use $github and $release_notes. On chat channels, /skill-name remains the standalone command form. A skill with disable-model-invocation: true stays out of the model's normal prompt, but an explicit reference still invokes it.
Installing skills from ClawHub: the commands that work
ClawHub is OpenClaw's public registry for skills and plugins. Search with openclaw skills search, install with openclaw skills install @owner/<slug>, and update with openclaw skills update --all. Installs land in the active workspace's skills folder by default, and the --global flag shares a skill with every local agent on the machine.
| Action | Command |
|---|---|
| Search the registry | openclaw skills search "calendar" |
| Install into the workspace | openclaw skills install @owner/<slug> |
| Install for all local agents | openclaw skills install @owner/<slug> --global |
| Install from Git | openclaw skills install git:owner/repo@ref |
| Install a local folder | openclaw skills install ./path/to/skill --as my-tool |
| Verify the trust envelope | openclaw skills verify @owner/<slug> |
| Update everything in the workspace | openclaw skills update --all |
| Debug eligibility | openclaw skills check |
What changed in 2026, and why old tutorials fail
OpenClaw no longer reads the pre-July 2026 metadata.clawdbot block. Rename it to metadata.openclaw and keep your requirements and installer fields, or the dependency gates are ignored. The same goes for the old .clawdhub metadata folder, which must be renamed to .clawhub before you update or verify skills.
Plugins use a different command from skills. According to the ClawHub docs (2026), OpenClaw releases through 2026.10.4 need the clawhub:<package> prefix to install a plugin from ClawHub, for example openclaw plugins install clawhub:<package>. Skills use the @owner/<slug> form shown above.
Git, local folders and skills.sh
Git and local installs expect a SKILL.md at the source root, and the slug comes from the frontmatter name. openclaw skills update only tracks ClawHub installs, so reinstall Git and local sources to refresh them. Installs from skills-sh:owner/repo/slug are shown as Not scanned by ClawHub, so treat them like any unreviewed repository.
Verifying before you trust
openclaw skills verify @owner/<slug> asks ClawHub for the skill's trust envelope and exits non-zero if verification failed. Add --card to print the generated Skill Card. ClawHub skill pages also show the latest scan state before install, with details from VirusTotal, ClawScan and static analysis. Use owner-qualified references so a bare slug cannot point to a different publisher.
Which skills to start with, and how to choose
Start with the skills OpenClaw ships, because they come from the project's own repository, and add community skills only when a bundled one does not cover the task. As of November 5, 2026 the repository's skills folder lists 50 bundled skills, from github, notion and obsidian to weather, summarize and tmux.
We do not publish a ranked "best skills" list, because download counts and star ratings are not safety signals. According to the Cloud Security Alliance (2026), IBM X-Force found that several malicious skills became some of the most downloaded on ClawHub before removal. What matters is what each skill can reach.
| Group | Examples from the bundled folder | What it can reach |
|---|---|---|
| Developer workflow | github, gh-issues, coding-agent, tmux | Repositories, issues, a shell |
| Notes and knowledge | notion, obsidian, apple-notes, bear-notes | Personal and company documents |
| Tasks | trello, apple-reminders, things-mac | Project boards and to-do data |
| Secrets | 1password | Credential vaults |
The grouping is ours, based on skill names, so read each SKILL.md to confirm what a skill touches. The coding-agent skill is opt-in: you enable it in config and need an authenticated coding CLI such as claude, codex or opencode.
How to evaluate a community skill
A skill is a bundle of instructions and scripts from a stranger. Check these signals before you install one:
| Signal | What to check | Why it matters |
|---|---|---|
| Publisher and source | Owner, linked repository, version history | Typosquats and throwaway accounts were common in the 2026 campaigns |
| Audit status and risk level | The security audit page for the release | A Review or Warn status means read the findings first |
| Declared access | Environment variables and binaries in the frontmatter | ClawHub flags a mismatch between declared and used credentials |
| Prerequisites section | Any step that asks you to run a command or download a file | Fake prerequisites were the main ClawHavoc delivery method |
| Remote instructions | Fetches of data or instructions from outside domains at run time | The publisher can change behavior after you install |
Writing your own skill
You can write a skill in about five minutes. Make a folder, add a SKILL.md with a name, a description and instructions, then check that it loads. Custom skills avoid the supply chain problem, because you know who wrote them.
Create the folder under your workspace, for example ~/.openclaw/workspace/skills/hello-world, and write the SKILL.md. Run openclaw skills list to confirm it loaded. OpenClaw watches skill files by default, but an existing session may need /new or a gateway restart to see the change.
Skill Workshop, covered in the v2026.8.1 release notes, goes a step further. It lets an agent save and update its own skills in a per-agent folder, with each change announced and the previous version kept so you can undo it. On a shared Gateway, personal skills are saved as immutable revisions, and a managed bundle is limited to 256 files, 1 MiB per file and 8 MiB in total.
OpenClaw skills security: what went wrong in 2026
ClawHub became a recurring malware channel in 2026. Koi Security found 341 malicious skills among 2,857 audited in February, and Unit 42 reported five more on June 23 that had passed ClawHub's automated scanning. The pattern is stable: a useful-looking skill, a fake prerequisite, and a payload that the agent or the user runs with full access.
| Date | Finding | Source |
|---|---|---|
| Early February 2026 | About 17% of skills Bitdefender Labs sampled in the first weeks carried malicious payloads | CSA, 2026 |
| February 2, 2026 | 341 of 2,857 audited skills were malicious, 335 of them in the ClawHavoc campaign | The Hacker News |
| Mid-February 2026 | A Koi follow-up counted 824 malicious skills across more than 10,700 listed | CSA, 2026 |
| 2026 | Trend Micro found 39 skills using a fake password dialog to deliver a stealer | CSA, 2026 |
| June 1, 2026 | ClawHub announced an NVIDIA partnership to document and analyze skills | CSA, 2026 |
| June 23, 2026 | Unit 42 reported five unblocked malicious skills that passed scanning | CSA, 2026 |
How the early attacks worked
According to The Hacker News (2026), 335 of the 341 malicious skills used fake prerequisites to install the Atomic macOS Stealer. The documentation looked professional, then asked the user to download a file on Windows or paste a script into Terminal on macOS. The skills posed as crypto tools, YouTube utilities, auto-updaters and Google Workspace helpers.
ClawHub is open by default. When Koi published, the only barrier was a GitHub account at least one week old. ClawHub's docs now say a publisher needs an account old enough to pass an upload gate, but anyone can still publish.
The 2026 shift: evasion and agentic abuse
By June, attackers had adapted to scanning. According to the Cloud Security Alliance (2026), one skill padded its package to roughly 22 megabytes so that scanners with file-size thresholds would skip it. Two others did not use malware at all. They used what Unit 42 called runtime affiliate injection and front-running, where the skill steers the agent's own actions for the attacker's financial gain.
Unit 42's write-up describes one case. The skill told the agent to fetch a product list from a remote file on every run and always use the affiliate links inside it. The publisher could change that file at any time. A scanner that looks for malware signatures finds nothing in a skill like that, because the harm is in the instructions.
Why marketplace scans are not enough
Marketplace scanning catches known malware patterns, but it cannot judge every instruction an agent might follow. A skill runs with the same privileges as the agent, so a bad skill needs no exploit. Scanners can be evaded, as the 22-megabyte padding case showed, and instruction-level abuse leaves no malware signature to detect.
ClawHub's own docs are candid about this. Audits combine three inputs: SkillSpector, the A.I.G scanner and a risk analysis. The docs call audits strong safety signals but not a guarantee that a release is risk-free.
| Audit status | Meaning in ClawHub's docs | What you should do |
|---|---|---|
| Pass | No visible issue above low risk | Still read the skill if it can run commands or reach credentials |
| Review | Read the findings before installing | Check whether the requested authority fits the purpose |
| Warn | A high-impact concern or warning signal | Use extra caution, or skip it |
| Malicious | Do not install | Remove it and rotate any credential it touched |
| Pending | Audits have not finished | Wait |
| Error | The audit could not be completed | Treat as unreviewed |
There is a second gap. According to the Cloud Security Alliance (2026), IBM X-Force found that OpenClaw-related disclosures are outpacing CVE assignment. Many skill-borne problems therefore never reach the vulnerability scanners that enterprises rely on. The CSA note recommends treating every skill installation as an unreviewed code execution event.
A safe-install checklist for skills
A safe-install routine combines review before install, limits on what each agent can load, and containment at run time. OpenClaw has controls for each step, and none of them depends on the marketplace being clean. Apply them in this order, starting with the cheapest.
| Control | How to apply it in OpenClaw | What it stops |
|---|---|---|
| Per-agent allowlist | Set agents.defaults.skills and agents.entries.<id>.skills; an empty list gives an agent no skills | One agent inheriting every installed skill |
| Read before enabling | Open the SKILL.md, scripts and the ClawHub audit page | Hidden prerequisites and remote fetches |
| Verify | openclaw skills verify @owner/<slug> | Installing a different version than the one you reviewed |
| Install policy | Configure security.installPolicy to run a trusted policy command before installs | Installs that skip your review rules |
| Sandbox | Prefer sandboxed runs for untrusted inputs and risky tools | A skill touching the host file system |
| Scoped secrets | Use skills.entries.<key>.env and keep credentials out of skill content | Secrets leaking through prompts and logs |
| Egress monitoring | Watch outbound connections from the agent host | Post-install calls to undocumented endpoints |
Two details matter. Env and API key injection applies to the host process for that agent turn, not to a sandbox. And a shared Gateway remains one trust domain: skills attached to a session are inputs to it, not secret storage.
Red flags that should stop an install
Do not install a skill that asks you to run a terminal command or download an archive before it works. Be wary of obfuscated shell commands, instructions to fetch other instructions from outside domains, bundled Python bytecode and undeclared credentials. ClawHub itself currently rejects skills containing .pyc, .pyo or .pyd files, because its scanner cannot inspect them.
Security and governance: control what skills can reach
Skills combine three of the biggest enterprise agent risks: untrusted instructions, tool misuse and data leakage. OWASP groups supply chain and tool abuse among its agentic risks, and the 2026 ClawHub incidents show them in practice. Your controls have to hold even when a skill is malicious, which means limiting what the agent can reach.
NeuralTrust approaches this as a Runtime Security Mesh. The Agent Gateway (TrustGate) routes model and tool traffic through one policy point. Its MCP Gateway lets you decide which tools each agent can access, with role-based permissions and read or write limits, and records which model reached which tool. Agent Runtime Security (TrustGuard) inspects agent interactions in real time, including tool responses, and applies prompt injection protection plus PII and secret detection.
That scope matters. A gateway governs the model and tool traffic that passes through it. An OpenClaw agent that sends its MCP calls and model requests through TrustGate gets least-privilege tool access and an audit trail. A skill that runs a local shell command or edits local files still needs the sandbox and egress controls above. The two layers work together.
The OWASP Top 10 for Agentic Applications 2026 is the framework to map these risks to, and our MCP security best practices checklist covers the server side. The same pattern appears in another fast-growing agent, as our Hermes Agent security analysis shows. You can start with the Free plan, which includes 100,000 requests per month.
Which setup should you choose?
Match your controls to what the agent can reach. A personal assistant on a spare machine needs different limits from an agent connected to company repositories. The more credentials an agent holds, the more you should rely on allowlists and isolation, not marketplace verdicts.
| Situation | Skills approach | Controls to add |
|---|---|---|
| Hobby use on a spare machine | Bundled skills first, a few reviewed community skills | Sandbox, no real credentials, openclaw skills verify |
| Developer on a work laptop | Bundled and self-written skills, community skills only after code review | Per-agent allowlist, scoped secrets, install policy |
| Team with shared agents | Curated internal skill set, no direct ClawHub installs | Allowlists, managed skills directory, egress monitoring |
| Enterprise or regulated data | Approved skills only, with provenance and review records | Gateway policy for tools, runtime inspection, audit logs |
Conclusion
OpenClaw skills are the fastest way to extend the agent and the easiest way to hand it a stranger's instructions. Use bundled skills first, read community skills before installing them, verify each one, limit every agent with an allowlist and run OpenClaw in a sandbox. The 2026 incidents show that registry scans catch known malware but not every evasion or agentic abuse, so your own controls are the real boundary.
Secure OpenClaw Skills in Production with NeuralTrust
Control which tools your agents can reach, inspect every interaction at runtime and keep an audit trail, starting free with 100,000 requests per month.
)
Related Comparisons
FAQs about OpenClaw Skills
1. What are OpenClaw skills?
OpenClaw skills are folders of markdown instructions built around a SKILL.md file with YAML frontmatter. They teach the agent how and when to use its tools. OpenClaw loads bundled skills plus your own and filters them by binaries, environment variables, config and operating system before the agent sees them.
2. How do I install OpenClaw skills?
Run openclaw skills install @owner/<slug> to install a ClawHub skill into the active workspace, or add --global to share it with every local agent. You can also install from git:owner/repo@ref or a local folder. Afterwards, run openclaw skills verify @owner/<slug> and openclaw skills check to confirm trust and eligibility.
3. Where does OpenClaw store skills?
Workspace skills live in <workspace>/skills, project agent skills in <workspace>/.agents/skills, personal ones in ~/.agents/skills and managed skills in the state directory's skills folder. Bundled skills ship with the install, and extra directories come from config. When names collide, the highest-precedence source wins.
4. Are OpenClaw skills safe?
Not by default. Skills run with the agent's authority, and 2026 research found hundreds of malicious skills on ClawHub, some of which passed automated scanning. The OpenClaw docs tell you to treat third-party skills as untrusted code, read them before enabling and prefer sandboxed runs. Bundled and self-written skills carry less risk.
5. What is the difference between OpenClaw skills and plugins?
Skills are markdown instructions that teach the agent how to use tools it already has. Plugins are code packages that add capabilities, and they can ship their own skills. Both are available from ClawHub, but plugin installs use openclaw plugins install and, on releases through 2026.10.4, need the clawhub: prefix.
6. How do I create a custom OpenClaw skill?
Create a folder such as ~/.openclaw/workspace/skills/hello-world, add a SKILL.md with a lowercase name, a one-line description under 160 characters and your instructions, then run openclaw skills list. Start a new session with /new if the agent does not see it. Skill Workshop can also draft skills for you.
7. Can I restrict which skills an agent can use?
Yes. Set agents.defaults.skills for a shared baseline and agents.entries.<id>.skills per agent, and an empty list gives an agent no skills. Allowlists control visibility, separate from where a skill is installed. You can also set skills.allowBundled so only listed bundled skills are eligible.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
Accessed on November 5, 2026.
- OpenClaw Docs, "Skills".
- OpenClaw Docs, "ClawHub".
- OpenClaw Docs, "Skill format".
- OpenClaw Docs, "Security Audits".
- OpenClaw Docs, "openclaw skills" CLI reference.
- OpenClaw Docs, "v2026.8.1: Skills", 2026.
- OpenClaw on GitHub, "skills" folder.
- Cloud Security Alliance AI Safety Initiative, "ClawHub Under the Microscope: Agentic AI Supply Chain Risk", July 7, 2026.
- The Hacker News, "Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users", February 2, 2026.
- Wikipedia, "OpenClaw".
)
)
)
)