ClawHub: Getting Started
/** Your gateway to 700+ community-built skills that extend OpenClaw's capabilities */
π€ What is ClawHub?
ClawHub is the official skill marketplace for OpenClaw β the community-curated registry of plugins that give your agent new capabilities beyond what comes installed. Think of it like npm for AI agents: each skill is a modular capability package that extends what OpenClaw can do, maintained by community contributors and vetted by automated security scanning. The breadth is remarkable: from headless Chrome browser automation to smart home device control, from natural language SQL querying to social media scheduling β if you can imagine it, someone has probably already built it. As of early 2026, ClawHub hosts over 700 skills across 24 categories, with 1.2 million monthly downloads and 2,800 active contributors. Most production OpenClaw users run between 5 and 12 skills. The ones who get the most value spend time finding the right 5 rather than installing 50.
π ClawHub by Numbers
β‘ Installing Your First Skill
Search for skills by keyword, or browse the web interface at hub.openclaw.dev. Filter by category, minimum rating (use 4.0+ to filter out low-quality entries), and Verified Publisher status. Pay attention to install counts β skills with 1,000+ installs have been battle-tested in real deployments.
The install command downloads the skill, resolves dependencies, and adds it to your skill config automatically. For skills that require API credentials, a post-install wizard walks you through configuration. Always install specific versions (e.g., browser-control@2.1.3) rather than the unversioned command, which resolves to 'latest'.
Lists all installed skills with version number, installation date, and current status (active/disabled/update-available). If a skill shows 'update-available', review the changelog before updating β check that the new version doesn't request additional permissions.
Just describe what you want in natural language. OpenClaw's router parses your intent and selects the best matching skill. You don't need to know the skill name or call any API β the agent handles routing automatically. If multiple skills could handle the request, it picks the one with the highest confidence match.
π Popular Categories
π Skill Safety
Since v2026.3.12, ClawHub includes automated malware scanning powered by a combination of static analysis and behavioral sandboxing. All published skills are audited for unauthorized network access, credential harvesting, file system abuse, and crypto mining before they appear in search results. The ClawHavoc incident (2025) found 847 malicious skills that evaded earlier detection methods β those tools directly informed the current scanning approach. When browsing, prioritize skills with a Trust Score above 85, Verified Publisher status, and a maintenance history showing updates within the last 60 days. Trust scores below 70 should be treated with caution regardless of install count. Always run 'npx carapace scan' after installing a new skill to get a local second opinion.
π Build Your Own Skill
Frequently Asked Questions
ClawHub skills are purpose-built for the OpenClaw runtime β they declare their tool access requirements, specify which channels they monitor, and integrate with OpenClaw's permission and approval system. An npm package runs in your Node.js process with whatever access Node has; a ClawHub skill runs in a sandboxed context with only the permissions you explicitly grant. The trust model is fundamentally different.
Yes β private skills can be installed from local directories or git repositories using the --local flag. Many teams maintain internal skills this way. The tradeoff is that private skills don't go through ClawHub's automated security scanning, so you're responsible for auditing them yourself before granting permissions.
Check the changelog in ClawHub before running 'openclaw skills update'. Look specifically for changes to declared permissions β any new permissions a skill is requesting should be treated like a new install and reviewed carefully. You can also run 'openclaw skills diff browser-control 2.1.2 2.1.3' to see exactly what changed in the skill code between versions.
Uninstalling a skill with 'openclaw skills uninstall <name>' removes the skill code and config but leaves data the skill stored in your SQLite backend or file system intact by default. If you want to delete skill-specific data as well, use the --purge flag. This distinction matters for skills like finance-tracker that accumulate transaction history over time.
The overhead per skill is very small at rest β skills only consume resources when invoked. The practical limit is about 20-25 active skills before the skill routing logic adds measurable latency to intent parsing. Most power users run 8-12 skills and disable ones they're not actively using, re-enabling them when needed with 'openclaw skills enable <name>'.
Both. The Developer Tools category has strong coverage for self-hosted tools: Gitea and Forgejo alongside GitHub, Grafana and Prometheus for monitoring, Paperless-ngx for documents, and many more. The Smart Home category is almost entirely self-hosted by nature. If a self-hosted tool has an API, there's a good chance someone in the community has built a ClawHub skill for it.
The 'mkdir -p ~/.openclaw/workspace/skills/my-skill # then write SKILL.md' scaffolding command generates the full boilerplate including TypeScript types, a test harness, and a sample tool declaration. The skills SDK documentation at hub.openclaw.dev/sdk covers the full API. Most community skills are built in a weekend β the hardest part is declaring permissions correctly so the sandbox doesn't reject your skill's legitimate operations.