# What are OpenClaw skills? How to install and use them > An OpenClaw skill is a folder with a SKILL.md file: a name, a description and the instructions your agent follows when a task fits. Install one from ClawHub with `openclaw skills install @owner/skill-name`, or put the folder in your workspace's `skills/` folder. Treat every skill from someone else as untrusted code, and read it before you enable it. Mindket editors · Published 2026-11-03 · Updated 2026-11-03 · https://mindket.com/blog/openclaw-skills ## In short - Install for one workspace first. Few skills need to reach every agent on the machine. - Ask `openclaw skills check` about a missing skill before you edit anything. - List every key and tool your skill uses in its frontmatter before the first upload. ## Install an OpenClaw skill from ClawHub `openclaw skills install` pulls a skill from [ClawHub](https://clawhub.ai), the public registry, into the active workspace's `skills/` folder. [OpenClaw](https://github.com/openclaw/openclaw) itself is an open-source assistant that runs on your own computer and answers you in chat apps such as Discord, Slack and Telegram. Before an install, open the skill's ClawHub page. It shows the latest security scan. A skill in the workspace folder wins a name clash with every other location. With `--global`, the install lands in `~/.openclaw/skills` instead, where every local agent can see it unless an allowlist narrows that. ````bash openclaw skills search "calendar" openclaw skills install @owner/skill-name openclaw skills list openclaw skills update --all ```` 1. Search with `openclaw skills search "calendar"`. Leave the query out to browse ClawHub's Trending feed. 2. Install with `openclaw skills install @owner/skill-name`. Add `--version` and a version number to choose a release. 3. Run `openclaw skills list` to confirm OpenClaw found the skill. 4. If an open chat doesn't offer the skill, send `/new` to start a fresh session. ## Use a skill, and find out why one is missing You don't have to call a skill by name. OpenClaw puts a short list of eligible skills into the agent's system prompt, each with its name, description and location, and the agent picks one by reading the descriptions. To call one anyway, open the Control UI with `openclaw dashboard`, type `$` and pick from your skills, as in `$release_notes`. One message can name up to eight. In chat, a skill named `hello-world` also runs as `/hello-world` or `/skill hello-world`. That slash command exists because `user-invocable` is true by default. Setting `disable-model-invocation: true` works the other way: the instructions stay out of the prompt and the model never picks the skill, though an explicit `$name` still runs it. Run `openclaw skills list --eligible` to see what an agent can use, and `openclaw skills check` to learn why a listed skill isn't ready. - A `metadata.openclaw.requires` block hides the skill until every binary in `bins` is on `PATH`, every variable in `env` is set and every path in `config` is truthy. The `anyBins` key needs only one binary from its list, and `os` filters by platform. - In a sandbox, the binary has to be inside the container as well, since `requires.bins` is checked on the host only. - An agent allowlist can hide it. A non-empty `agents.entries.*.skills` list replaces the defaults instead of adding to them, and an empty one exposes nothing at all. ## Write a skill of your own The sample below turns recent git commits into a draft changelog. Its folder is named `changelog-from-git`, and so is its `name`, which must use lowercase letters, digits and hyphens and match the folder. The `description` is a single line under 160 characters, since it is what the agent reads in its context and what slash-command discovery shows. Write the description as what the skill does plus the requests that should [bring it in](https://mindket.com/blog/how-to-create-agent-skill), here a changelog, release notes or what changed since the last tag. The `metadata` line keeps the skill hidden on any machine without `git`. ````markdown --- name: changelog-from-git description: Drafts a changelog from recent git commits. Use when the user asks for a changelog, release notes or what changed since the last tag. metadata: { "openclaw": { "requires": { "bins": ["git"] } } } --- # Changelog from git 1. Run `git describe --tags --abbrev=0` to find the last tag. If there is none, ask which commit to start from. 2. Run `git log TAG..HEAD --oneline`, with that tag in place of TAG, and read the list. 3. Group the commits under Added, Changed and Fixed. Skip merge commits. 4. Write one plain line per change. Never invent an issue number. ```` 1. Create the folder: `mkdir -p ~/.openclaw/workspace/skills/changelog-from-git`. 2. Save the sample as `SKILL.md` inside it. 3. Run `openclaw skills list`. OpenClaw watches `SKILL.md` files by default, so the skill should appear. 4. Try it from the terminal with `openclaw agent --message "write a changelog since the last tag"`, or name it in a chat with `/skill changelog-from-git`. > A skill that calls the `exec` tool needs a prompt that untrusted input can't turn into a shell command. For a file in the skill's own folder, write `{baseDir}`, as in `{baseDir}/scripts/run.sh`, not a fixed path. ## How OpenClaw skills relate to the Agent Skills format OpenClaw follows the [Agent Skills specification](https://agentskills.io/specification), so a folder with a `SKILL.md`, a `name` and a `description` works in every tool that [reads the format](https://mindket.com/blog/what-are-agent-skills). Names follow the same rule in both, up to 64 characters, but descriptions don't. A skill imported from another tool may have one of up to 1,024 characters, so trim it to OpenClaw's one line first. A description written for OpenClaw already fits the specification's limit. Beyond those two, the specification lists `license`, `compatibility`, `metadata` and an experimental `allowed-tools`. OpenClaw adds `user-invocable`, `disable-model-invocation`, `command-dispatch` and `homepage`, none of them in the specification, and stores its gates in `metadata`, the field the specification leaves to each client. The specification expects strings in that field, though, and OpenClaw reads nested objects. **How long a skill description may be** OpenClaw asks for a single line. The specification only sets a ceiling. - OpenClaw, per its creating-skills page: 160 characters - Agent Skills specification, the maximum: 1,024 characters Sources: [OpenClaw docs: Creating skills](https://docs.openclaw.ai/tools/creating-skills) (read 2026-11-03), [Agent Skills specification](https://agentskills.io/specification) (read 2026-11-03) ## Publish a skill to ClawHub Publishing uses a separate CLI, `clawhub`, which the [ClawHub quickstart](https://docs.openclaw.ai/clawhub/quickstart) has you install from npm and sign in to with GitHub. A new skill starts at 1.0.0, and each later change goes out as the next patch version. Add `--dry-run` to preview the upload. Unchanged content is skipped. The GitHub account can't be brand-new. Peter Steinberger, OpenClaw's creator, [announced that gate on X](https://x.com/steipete/status/2018297794952651111) along with a way for users to report skills. Write the environment variables, tools and permissions the skill needs into its frontmatter before you publish. ClawHub's security analysis [holds those declarations up against what the skill does](https://docs.openclaw.ai/clawhub/skill-format) and flags a mismatch. ````bash npm i -g clawhub clawhub login clawhub skill publish ./changelog-from-git ```` [![Peter Steinberger (@steipete) on X, 2 February 2026. He says he has spent time making ClawHub more secure. Users can now report skills, and only people with a GitHub account that is not brand-new can upload skills. He expects this to make ClawHub a much more trusted place.](https://mindket.com/blog/shots/x-steipete-clawhub-upload-gate.webp?v=d9cbf6de040b)](https://x.com/steipete/status/2018297794952651111) Peter Steinberger on X, 2 February 2026 > The screenshot is X's own embed of Peter Steinberger's post. Select it to open the post on X. ## Read a skill before you install it Unless you set up sandboxing, tools in the main session run on the host, which means your own machine. Whatever a skill tells the agent to run, it runs there. ClawHub scans every release, and a skill's audit page shows the outcome: Pass, Review, Warn, Malicious, Pending or Error, with a risk level and the findings. Malicious means don't install. Review is not an accusation. ClawHub's own example is a publishing skill that acts with meaningful authority over an account. And a Pass, the [security audits page](https://docs.openclaw.ai/clawhub/security-audits) adds, doesn't replace your own judgment. Once a skill is installed, `openclaw skills verify @owner/skill-name` prints ClawHub's trust envelope for it, and `--card` prints its Skill Card. Installs through `skills-sh:` carry the label "Not scanned by ClawHub". `--force-install` lets a GitHub-backed skill in before ClawHub's scan finishes, with no verdict yet. Leave that flag off and install once the scan has one. Koi Security's audit took every skill on ClawHub at one moment, reported in early February. Antiy CERT counted packages across ClawHub's whole history, all from 12 author IDs. OpenClaw's June dataset covers the latest public skill versions, and its three scanners seldom flagged the same one. **What the reports counted** - **341 of 2,857** skills Koi Security flagged as malicious when it audited every skill on ClawHub, reported in early February 2026 (Source: [eSecurity Planet](https://www.esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub/), read 2026-11-03) - **1,184** malicious skill packages Antiy CERT found in ClawHub's whole history by 5 February 2026, from 12 author IDs (Source: [Antiy CERT](https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/), read 2026-11-03) - **67,453** latest public skill versions in the ClawHub scan dataset OpenClaw published on 1 June 2026 (Source: [OpenClaw blog: NVIDIA and skill security](https://openclaw.ai/blog/openclaw-nvidia-skill-security), read 2026-11-03) > ClawHub skill pages expose scan state before install, but scans are not a complete security boundary. OpenClaw does not run built-in local dangerous-code blocking during plugin/skill install or update. > > OpenClaw documentation, [OpenClaw FAQ, Security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) (read 2026-11-03) - Read `SKILL.md` for every command it tells the agent to run through `exec`, and for what it does with the input. - Open every file beside it. ClawHub publishes all regular files in a skill folder, so a `scripts/` directory can hold much more than instructions. - Check `requires.env` and `primaryEnv` for the secrets and keys the skill asks for. - Look for an `install` block. It can fetch dependencies with brew, node, go, uv or a download, and a download entry may carry a `sha256` that OpenClaw checks before it installs the file. That field is optional. **How ClawHub's scanning grew in 2026** 1. **January 31, 2026** Malicious skills arrive in bulk. Antiy CERT dates the start of the mass release to this day: 7 attackers deploy 386 malicious skills, 354 of them from one account. 2. **February 2, 2026** A report button and an upload gate. Peter Steinberger says users can now report skills, and only accounts that are not brand-new on GitHub can upload them. 3. **February 2, 2026** 341 malicious skills reported. Oren Yomtov says his team found 341 malicious skills on ClawHub aimed at OpenClaw bots, and releases Clawdex, a skill that checks other skills. 4. **February 6, 2026** VirusTotal scans every skill. OpenClaw says every ClawHub skill is now scanned for malware, with verdicts in about 30 seconds and daily re-scans, and calls it not a silver bullet. 5. **June 1, 2026** Skill Cards and SkillSpector. Every skill gets a Skill Card, and NVIDIA's SkillSpector scans for hidden instructions. ClawScan weighs it with VirusTotal and OpenClaw's static analysis. 6. **October 2, 2026** Tencent AIG joins ClawScan. Every skill and plugin uploaded to ClawHub now also runs through Tencent's AI-Infra-Guard as part of its security review. Sources: [Antiy CERT](https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/) (read 2026-11-03), [Peter Steinberger on X](https://x.com/steipete/status/2018297794952651111) (read 2026-11-03), [Oren Yomtov on X](https://x.com/orenyomtov/status/2018323558746014087) (read 2026-11-03), [OpenClaw on X](https://x.com/openclaw/status/2019865921175577029) (read 2026-11-03), [OpenClaw blog: NVIDIA and skill security](https://openclaw.ai/blog/openclaw-nvidia-skill-security) (read 2026-11-03), [OpenClaw blog: Tencent AIG joins ClawScan](https://openclaw.ai/blog/tencent-aig-joins-clawscan) (read 2026-11-03) **Share of ClawHub skill versions each scanner flags** Gold: flagged by all three at once. A flag is a finding, not a verdict, and 81.9% of the flags came from one scanner alone. - SkillSpector, NVIDIA's agent-skill scanner: 48.71% - VirusTotal: 7.75% - OpenClaw's static analysis: 6.57% - All three at once: **0.69%** Source: [OpenClaw blog: NVIDIA and skill security](https://openclaw.ai/blog/openclaw-nvidia-skill-security) (read 2026-11-03) [![Oren Yomtov (@orenyomtov) on X, 2 February 2026. He says "we found 341 malicious skills on ClawHub targeting OpenClaw bots". He then built Clawdex, a skill that lets your bot check a skill before installing it. The picture is the Clawdex checker with one skill marked malicious.](https://mindket.com/blog/shots/x-orenyomtov-341-malicious-skills.webp?v=26cae9c25a10)](https://x.com/orenyomtov/status/2018323558746014087) Oren Yomtov on X, 2 February 2026 [![OpenClaw (@openclaw) on X, 6 February 2026. Every ClawHub skill is now auto-scanned for malware with VirusTotal. The post lists AI Code Insight, verdicts in about 30 seconds, Benign, Suspicious and Malicious tiers, and daily re-scans. It says this is not a silver bullet.](https://mindket.com/blog/shots/x-openclaw-virustotal-scan.webp?v=82a57465b567)](https://x.com/openclaw/status/2019865921175577029) OpenClaw on X, 6 February 2026 > On your own machine, `security.installPolicy` runs a policy command of yours before any install goes ahead. The [security FAQ](https://docs.openclaw.ai/help/faq/security-and-access-control) also suggests pinned versions, narrow allowlists and `openclaw security audit --deep` after a config change. Both screenshots are X's embeds, with the link card under the OpenClaw post left out and its last line shortened by X. Select one to open the post. ## Reference: where OpenClaw looks for skills, highest first A name clash goes to the skill higher in the table. Row 1 is where the [creating-skills page](https://docs.openclaw.ai/tools/creating-skills) builds its first skill, `~/.openclaw/workspace/skills`. Subfolders are fine. OpenClaw finds a `SKILL.md` up to six folders below a root, so `skills/personal/research/SKILL.md` loads as `research`. The grouping is for you alone: the name and the slash command come from the `name` field, or from the directory name when `name` is missing. | Order | Location | Notes | | --- | --- | --- | | 1 | `WORKSPACE/skills` | Only that agent sees it. Wins a name clash. | | 2 | `WORKSPACE/.agents/skills` | Only that workspace's agent. | | 3 | `~/.agents/skills` | Agents on the default state. Not read when the state folder has been moved. | | 4 | `STATE_DIR/skills` | Shared by every agent on that state. `--global` installs write here. | | 5 | `STATE_DIR/agents/AGENT_ID/agent/workshop-skills` | Skills the agent learned by itself. Only that agent. | | 6 | Bundled with OpenClaw | Ships with the install. | | 7 | `skills.load.extraDirs` | Folders you add in the config, plus skills that plugins ship. | > WORKSPACE is an agent's workspace folder, and STATE_DIR is OpenClaw's state folder, `~/.openclaw` unless `OPENCLAW_STATE_DIR` points elsewhere. ## Reference: installing from Git, a local folder or skills.sh The install command takes other sources too. `git:owner/repo@ref` clones a Git skill, `./path/to/skill --as my-tool` copies a local folder, and `skills-sh:owner/repo/slug` asks ClawHub to resolve a skills.sh listing to a pinned GitHub commit. Git and local installs need `SKILL.md` at the source root. Only ClawHub installs are tracked, in `.clawhub/lock.json` in the workspace and in `.clawhub/origin.json` inside each installed skill. Folders named `.clawdhub`, from before July 2026, are no longer read: rename them to `.clawhub` before you update or verify an older install. ## Frequently asked questions ### Can I use a skill written for Claude Code or Codex in OpenClaw? Usually, since all three read a `SKILL.md` folder: copy it into one of OpenClaw's roots, such as the workspace `skills/` folder. The two `.agents/skills` roots are folders Codex [reads as well](https://mindket.com/blog/codex-skills), but Codex's own `$CODEX_HOME/skills` isn't one of OpenClaw's. `openclaw migrate plan codex` lists what it holds, and `openclaw migrate codex` copies it into your workspace. For Claude Code and Claude Desktop there is a bundled [migrate-claude plugin](https://docs.openclaw.ai/plugins/reference/migrate-claude) that brings over instructions, MCP servers and skills. ### Can I sell an OpenClaw skill on ClawHub? No. Every skill published there is licensed MIT-0, so anyone may use, change and redistribute it, commercially too, without attribution. Nor does ClawHub have paid skills, per-skill pricing, paywalls or [revenue sharing](https://docs.openclaw.ai/clawhub/skill-format). A skill that calls a paid service should say so in its instructions and declare the variables it needs. ### How do I update or remove a skill? `openclaw skills update --all` updates every ClawHub-tracked skill in the workspace, and `--global` does the same for the shared folder. Git and local installs aren't tracked, so reinstall those with `--force` over the old folder. Removing a ClawHub skill takes the standalone CLI: `clawhub uninstall @owner/skill-name`, run against the root it was installed in. ### How do I turn a skill off without deleting it? Give its entry under `skills.entries` in `~/.openclaw/openclaw.json` the line `enabled: false`. The key is the skill's name, in quotes if it has hyphens, and this works for bundled and installed skills alike. To switch off every bundled skill and nothing else, set `allowBundled: []`. ### What is the difference between a skill and a plugin in OpenClaw? A skill is a `SKILL.md` and the files beside it, while a plugin is a code package built for OpenClaw. ClawHub hosts both, skills as versioned text bundles and plugins with compatibility metadata. They overlap when a plugin lists `skills` directories in `openclaw.plugin.json`: those skills load whenever the plugin is enabled. Plugins install with `openclaw plugins install clawhub:package-name`, a prefix that released versions through 2026.10.4 need. ### Can my agent write its own skills? Yes. [Skill Workshop](https://docs.openclaw.ai/tools/skill-workshop), a bundled plugin that is on by default, lets the agent save the procedure behind hard multi-step work as a learned skill. Each change applies at once and keeps the previous version, and a skill nobody uses for 30 days is archived. `openclaw skills workshop list` shows them, while `archive` or `restore` undoes a change. A learned skill belongs to one agent and ignores that agent's allowlists, so you hide one by archiving it. ### Do installed skills cost tokens? Yes, a little per skill. Each one adds about 97 characters to the prompt plus its name, description and location, or roughly 24 tokens before those fields, by the Skills page's count. With enough skills the prompt budget runs out, and OpenClaw then keeps names and locations but shortens descriptions. A skill that drops off the list can still be found with `skills_search` when that tool is enabled. If you see descriptions cut short, shorten the longest ones in your own skills. ## Sources - [OpenClaw docs: Skills](https://docs.openclaw.ai/tools/skills) (read 2026-11-03) - [OpenClaw docs: Creating skills](https://docs.openclaw.ai/tools/creating-skills) (read 2026-11-03) - [OpenClaw docs: Skills config](https://docs.openclaw.ai/tools/skills-config) (read 2026-11-03) - [OpenClaw docs: Skills CLI](https://docs.openclaw.ai/cli/skills) (read 2026-11-03) - [OpenClaw docs: ClawHub](https://docs.openclaw.ai/clawhub) (read 2026-11-03) - [OpenClaw docs: ClawHub quickstart](https://docs.openclaw.ai/clawhub/quickstart) (read 2026-11-03) - [OpenClaw docs: ClawHub skill format](https://docs.openclaw.ai/clawhub/skill-format) (read 2026-11-03) - [OpenClaw docs: ClawHub security audits](https://docs.openclaw.ai/clawhub/security-audits) (read 2026-11-03) - [OpenClaw docs: Security and access control FAQ](https://docs.openclaw.ai/help/faq/security-and-access-control) (read 2026-11-03) - [OpenClaw docs: Skills and automation FAQ](https://docs.openclaw.ai/help/faq/skills-and-automation) (read 2026-11-03) - [OpenClaw docs: Skill Workshop](https://docs.openclaw.ai/tools/skill-workshop) (read 2026-11-03) - [OpenClaw docs: Migrate Claude plugin reference](https://docs.openclaw.ai/plugins/reference/migrate-claude) (read 2026-11-03) - [GitHub: openclaw/openclaw README](https://github.com/openclaw/openclaw) (read 2026-11-03) - [GitHub: openclaw/clawhub README](https://github.com/openclaw/clawhub) (read 2026-11-03) - [ClawHub](https://clawhub.ai) (read 2026-11-03) - [Agent Skills specification](https://agentskills.io/specification) (read 2026-11-03) - [OpenClaw blog: OpenClaw Collaborates with NVIDIA for Stronger Agent Skill Security](https://openclaw.ai/blog/openclaw-nvidia-skill-security) (read 2026-11-03) - [OpenClaw blog: Tencent AIG joins ClawScan](https://openclaw.ai/blog/tencent-aig-joins-clawscan) (read 2026-11-03) - [Antiy CERT: ClawHavoc analysis (English edition)](https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/) (read 2026-11-03) - [eSecurity Planet: Hundreds of Malicious Skills Found in OpenClaw's ClawHub](https://www.esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub/) (read 2026-11-03) - [Peter Steinberger on X: ClawHub reports and the upload gate](https://x.com/steipete/status/2018297794952651111) (read 2026-11-03) - [Oren Yomtov on X: 341 malicious skills on ClawHub](https://x.com/orenyomtov/status/2018323558746014087) (read 2026-11-03) - [OpenClaw on X: every ClawHub skill now scanned with VirusTotal](https://x.com/openclaw/status/2019865921175577029) (read 2026-11-03) [Browse kits](https://mindket.com/kits)