OpenClaw skills and ClawHub: what's there, how to vet one (2026)

OpenClaw skills are small packages of instructions, a SKILL.md file plus optional scripts, that teach the agent a task or how to use a tool, and ClawHub is the public registry you install them from: OpenClaw’s own security scan covered 67,453 of them in June 2026. Many are useful, but researchers found hundreds of malicious skills on ClawHub in early 2026, and OpenClaw’s docs say to treat every third-party skill as “untrusted code”, so read one before you install it.

We haven’t installed or reviewed these skills ourselves. This guide draws on OpenClaw’s and ClawHub’s documentation, ClawHub’s public API as read on October 20, 2026, and published security research (see how we work).

Skills, plugins and MCP: what’s the difference

OpenClaw has three ways to add abilities, and they carry different risks:

	Skill	Plugin	MCP server
What it is	Markdown instructions that teach the agent when and how to use tools	Code that adds chat channels, model providers, tools, hooks or skills	An outside server whose tools the agent can call
Where it runs	In the prompt; any commands run through the agent’s own tools	Inside the Gateway process	In its own process, local or remote
Install with	openclaw skills install	openclaw plugins install	openclaw mcp add
The docs’ advice	Treat as “untrusted code”	Runs as “trusted code”, so install only what you trust	Its tools still obey your tool policy

Sources: skills, plugins, tool permissions, MCP.

Plugins deserve the most care. They run in-process with the Gateway, so the docs say to “treat plugin installs like running code”, keep an explicit plugins.allow list (a plugins.deny entry always wins) and pin exact versions. Plugins come from ClawHub by default, but npm, git, local paths and archives work too. A ClawHub security audit runs when you install or update one (plugins CLI), but OpenClaw “does not run built-in dangerous-code blocking during install”; security.installPolicy lets you plug in your own allow, warn or block check.

MCP works in both directions. OpenClaw can use tools from MCP servers registered under mcp.servers (stdio, SSE/HTTP or streamable HTTP, with OAuth login for remote servers), and openclaw mcp serve exposes OpenClaw’s own conversations to other MCP clients (MCP CLI). MCP tools still pass through your tool policy, and sandboxed sessions only get the ones listed in tools.sandbox.tools (tool policy). One MCP flaw, CVE-2026-44118, let local clients pose as the owner until it was fixed in 2026.4.22.

What a skill is made of

A skill is a folder with one required SKILL.md, Markdown with optional YAML frontmatter, plus any supporting files, up to 50 MB in total. Every ClawHub skill is licensed MIT-0, and paid skills aren’t supported (skill format). The format follows the AgentSkills spec, the same one Hermes Agent uses.

The frontmatter declares what the skill needs:

Field	What it declares
name, description	What the skill does and when to use it; this is what the agent sees in every prompt
version	A semantic version number
requires.bins, requires.anyBins	Programs it needs on the machine
requires.env, primaryEnv, envVars	Environment variables, such as API keys
requires.config	OpenClaw settings it depends on
install	How to install its dependencies: brew, node, go or uv

Everything after version sits under metadata.openclaw. ClawHub’s analysis flags code that uses an environment variable the skill didn’t declare, which makes the declarations worth reading.

Installing and updating skills

OpenClaw’s own commands install from ClawHub (skills):

openclaw skills install @owner/<slug>    # add --global for ~/.openclaw/skills
openclaw skills update --all
openclaw skills verify @owner/<slug>

The separate clawhub install command puts skills in ./skills and records their versions in .clawhub/lock.json (ClawHub).

When two sources hold skills, the highest-priority one wins. From highest: the workspace’s skills/ folder, then <workspace>/.agents/skills, ~/.agents/skills, managed skills, workshop skills, bundled skills, and finally extra folders and plugin skills. So anyone who can write to your workspace’s skills/ folder can change what your agent does, and the docs say to “treat skill folders as trusted code and restrict who can modify them” (tool permissions). One more detail: secrets you set for a skill in skills.entries are injected into the host process for that turn, not into the sandbox.

How ClawHub vets skills

ClawHub’s checks have grown in stages:

When	What changed
As reported Feb 2, 2026	Anyone with a GitHub account at least a week old could publish. A report button was added; skills with more than 3 unique reports were hidden (The Hacker News)
Feb 7, 2026	VirusTotal partnership: each skill is hashed and scanned, and an AI review reads it from SKILL.md on. Benign skills are approved, Suspicious ones get a warning, Malicious ones are blocked from download, and active skills are re-scanned daily (OpenClaw blog)
Jun 1, 2026	NVIDIA’s SkillSpector added, with an AI “ClawScan judge” issuing Clean, Suspicious or Malicious verdicts (OpenClaw blog)
Oct 2, 2026	Tencent’s AIG scanner added to ClawScan for every uploaded skill and plugin (OpenClaw blog)

Today a skill’s audit shows one of six statuses: Pass, Review, Warn, Malicious (“do not install”), Pending or Error. Compiled Python files are rejected, and held, hidden, quarantined or revoked listings can’t be installed (security audits, moderation).

The scanners disagree a lot. In OpenClaw’s June dataset of 67,453 skills, the pipeline returned 206 Malicious and 25,504 Suspicious verdicts; SkillSpector flagged 48.71% of skills, VirusTotal 7.75% and static analysis 6.57%, and only 468 skills (0.69%) were flagged by all three. False alarms are common too: in the month before April 30, about 460 of the 700-plus moderation issues closed were appeals from authors who had been wrongly flagged (OpenClaw blog).

The project is frank about the limits. The VirusTotal post says “this is not a silver bullet” and that “A carefully crafted prompt injection payload won’t show up in a threat database”. The audit docs call results “strong safety signals, but they are not a guarantee”. And the threat model notes that “No runtime execution sandbox isolates a skill from the agent’s own privileges once installed”.

Two details conflict between sources. The threat model now lists a 14-day GitHub account age check, against the one week reported in February. And OpenClaw’s security page still names VirusTotal among the checks, while the current audit docs don’t name it.

What researchers found

Who	When	What they examined	What they found
Cisco	Jan 28	One top-ranked skill	“What Would Elon Do?” quietly sent data to its author and told the agent to skip safety guidelines: “functionally malware”
Koi Security, via The Hacker News	Feb 2	2,857 ClawHub skills	341 malicious, 335 of them in one campaign, “ClawHavoc”
Snyk	Feb 5	3,984 skills on ClawHub and skills.sh	534 with a critical issue; 76 confirmed malicious, 8 still live
Antiy CERT	Feb 6	ClawHub’s history	At least 1,184 malicious skills from 12 accounts, one of which published 677
Unit 42	Jun 23	February to May	5 malicious skills that got past the scanners, since removed

The counts aren’t comparable: they cover different dates, scopes and definitions. Koi’s original post now redirects elsewhere, so its figures come from The Hacker News and CyberInsider.

The methods matter more than the counts, because they tell you what to look for:

• Fake prerequisites. ClawHavoc skills had a “Prerequisites” step that told you to paste a script from glot.io, which fetched more stages and ended with a Mac binary consistent with the Atomic Stealer (AMOS). On Windows, the lure was a password-protected openclaw-agent.zip hiding a keylogging trojan.
• Hidden payloads. Other skills opened reverse shells or sent the ~/.clawdbot/.env settings file to webhook.site. Snyk also found base64-hidden curl uploads and systemctl backdoors.
• Prompt injection. Snyk said 91% of its confirmed-malicious skills combined prompt injection with malicious code.
• Scanner evasion. Unit 42 found a skill that padded its README to 22 MB to exceed scanner size limits, and others that abused the agent itself, slipping in affiliate links or front-running trades.
• Lures. Koi’s researcher counted crypto tools (111), YouTube tools (57), finance and social tools (51), prediction markets (34), auto-updaters (28) and Google Workspace integrations (17) (CyberInsider).

Most-downloaded skills on ClawHub

ClawHub’s public API ranks skills by downloads. The table shows the top 15 on October 20, 2026. Popularity isn’t endorsement. We haven’t reviewed these skills’ code, and Cisco’s case shows a malicious skill can be pushed to the top.

A few patterns stand out:

• Memory and self-improvement lead. Four of the top eight promise to make the agent learn from its mistakes or remember more.
• Two of the top seven vet other skills. They’re skills like any other, with the same access as the rest; a vetting skill doesn’t replace reading the code.
• Five of the top 15 are published as steipete, the handle OpenClaw’s credits list for its creator, Peter Steinberger. All 15 trending skills (installs in the past week) were steipete skills too, led by sonoscli, gog, github, weather and openai-whisper (ClawHub API).

ClawHub, October 20, 2026

The 15 most-downloaded OpenClaw skills

Ranked by ClawHub's download count. Descriptions paraphrase each skill's own summary. Filter by kind.

All 15Memory and self-improvement 4Skill vetting 2Work apps 3Web and search 3Notes, docs and writing 3By steipete 5

Skill	Publisher	What it says it does	Downloads	Stars
self-improving-agent	pskoett	Logs errors, corrections and lessons for the agent to reuse	486,752	4,003
skill-vetter	spclaudehome	Checks other skills for red flags and permission scope before install	278,551	1,308
self-improving	ivangdavila	Self-review and self-organizing memory	212,241	1,299
github	steipete	Issues, pull requests and CI runs through the gh CLI	201,667	671
ontology	oswalpalash	A typed knowledge graph for structured agent memory	200,422	660
gog	steipete	Gmail, Calendar, Drive, Contacts, Sheets and Docs from a CLI	197,472	953
skillscan	tokauthai	Tells the agent to scan every new skill before use	182,728	41
proactive-agent	halthelobster	Makes the agent anticipate needs, with scheduled jobs	177,787	831
weather	steipete	Current weather and forecasts, no API key	172,047	430
multi-search-engine	gpyangyoujun	Searches across 16 search engines	163,576	764
agent-browser-clawdbot	matrixy	Headless browser automation for agents	158,264	463
admapix	fly0pants	Ad creative and app-market data from the AdMapix API	133,983	296
humanizer	biostartechnology	Edits text to remove signs of AI writing	132,933	720
nano-pdf	steipete	Edits PDFs from plain-language instructions	122,898	273
obsidian	steipete	Works with Obsidian vaults of Markdown notes	111,856	462

Showing all 15.

Source: ClawHub public API and by stars, read October 20, 2026. Downloads are ClawHub’s own counter; the API’s separate installs figure is far lower (18,494 for the top skill). We have not reviewed these skills’ code.

Plugins are a smaller market. The four most downloaded are official @openclaw packages: @openclaw/whatsapp (200,406), @openclaw/codex (57,807), @openclaw/matrix (55,450) and @openclaw/deepseek-provider (29,477) (ClawHub API).

How to vet a skill before you install it

No scanner catches everything, so the last check is yours. The docs’ advice is to read third-party skills before enabling them and to prefer sandboxed runs. Singapore’s IMDA, in guidance reported in May, went further: install skills only from verified publishers with public, maintained source (People Matters).

The checklist turns the docs’ guidance and the research above into steps. A skill that fails a critical item shouldn’t be installed.

Checklist

Vet a skill before you install it

Tick what you have checked for the skill in front of you. Critical items count three times as much as good-to-haves. Ticks are saved in this browser only; clear them for the next skill.

Tick what you've done0%

Items are weighted: critical ones count three times as much as nice-to-haves.

• Read SKILL.md and every file in the folderCriticalThe docs call third-party skills "untrusted code" and say to read them before enabling. Skills
• ClawHub audit status is PassCriticalNever install Malicious; treat Review and Warn as reasons to read closer. Audits are "not a guarantee". Security audits
• No "prerequisite" commands to paste or runCriticalThe ClawHavoc vector: a setup step that sends you to a script on a paste site. Real dependencies go in the install field. The Hacker News
• No curl-to-shell, password-protected zips or downloaded binariesCriticalSnyk and Koi found payloads delivered exactly this way. Snyk
• Requested programs and env vars fit its purposeImportantCheck requires.bins and requires.env: a weather skill has no reason to want your email keys. Skill format
• Publisher has a history and public sourceImportantAntiy traced at least 1,184 malicious skills to 12 accounts, one with 677 uploads. Antiy
• No instructions aimed at the agentImportantLines telling it to skip safety rules, hide what it does or send data to a URL. Snyk found 91% of malicious skills mixed prompt injection with code. Snyk
• Tried first in a sandboxed agentImportantThe docs prefer sandboxed runs. Secrets set in skills.entries still reach the host process. Skills
• Updates reviewed before you apply themImportantRead what changed in each new version; CNCERT and ThaiCERT advise against automatic add-on updates. ThaiCERT
• Version pinnedGood to haveclawhub install records versions in .clawhub/lock.json. ClawHub
• No oversized or padded filesGood to haveUnit 42 found a README padded to 22 MB to get past scanner size limits. Unit 42
• Not chosen on popularity aloneGood to haveCisco found a malicious skill inflated to rank first. Cisco

Clear all ticks

How many skills should you install?

Fewer than you might think. Every installed skill adds an entry to the prompt of every model call, heartbeats included: “~97 characters + your name, description, and location”, or roughly 24 tokens before those fields (skills). In the docs’ own /context list example, 12 skills took 2,184 characters, about 546 tokens (context). A hosting vendor, Phala, measured about 1,200 tokens for 10 built-in skills (Phala).

That’s modest on its own, but it rides along on every call; see what OpenClaw costs to run. The bigger cost is risk: each skill is more instructions the agent will follow. Install the few you use, remove the rest, and check sizes with /context detail. For the wider security setup, see is OpenClaw safe?

FAQ

What are OpenClaw skills?

Folders with a SKILL.md file of instructions, plus optional scripts, that teach the agent a task or how to use a tool. They follow the AgentSkills format and are installed from ClawHub, OpenClaw’s public registry.

Are ClawHub skills safe?

Not automatically. ClawHub now scans every version with several tools, but researchers found hundreds of malicious skills in early 2026 and a few that slipped past the scanners until May. Read each skill, check its audit status, and try it in a sandboxed agent first.

What are the best OpenClaw skills?

By downloads on October 20, 2026, the leaders were self-improving-agent, skill-vetter, self-improving, github and ontology. That measures popularity, not quality or safety, and we haven’t reviewed their code. The best skills for you are the few that match tasks you actually do.

Does OpenClaw support MCP?

Yes, both ways. It can call tools from MCP servers you register, subject to your tool policy, and openclaw mcp serve lets other MCP clients reach its conversations (MCP).

Can Hermes Agent use OpenClaw skills?

Yes. Hermes uses the same SKILL.md format, and its hub installs, ClawHub included, go through its own security scanner, which won’t let you force through a skill it rates dangerous (Hermes skills). See OpenClaw vs Hermes Agent.