OpenClaw Skills: How to Find, Install, and Build Custom Skills with ClawHub product guide

I now have comprehensive, well-sourced information to write the article. Let me compose the final, verified article.

What OpenClaw Skills Are — and Why They Define the Platform's Power

OpenClaw without skills is a capable conversational agent. OpenClaw with the right skills is something closer to a personal operations centre. A skill is a plugin or extension that adds a specific capability to your AI assistant — each one teaches OpenClaw how to interact with a new service, device, or workflow. Without skills, OpenClaw is a smart conversational assistant with memory and proactive features; with the right skills installed, it becomes a personal operations centre that manages your calendar, controls your home, triages your email, runs your development pipeline, and more.

That distinction matters enormously. The Skills system is not an afterthought bolted onto OpenClaw's core — it is the primary extensibility layer that allows a single, locally-running agent to adapt to virtually any professional or personal workflow. OpenClaw skills are designed to make working with OpenClaw's AI agents more practical, modular, and powerful. Instead of building every capability from scratch, skills let you package specific functionality — like calling an API, querying a database, retrieving documents, or executing a workflow — into reusable components that an agent can invoke when needed. This approach keeps your agent logic clean and flexible, while making it easier to extend what your agent can do over time without rewriting core architecture.

This guide covers the full skills lifecycle: what a SKILL.md file actually contains, how OpenClaw resolves skills across bundled, global, and workspace scopes, how to browse and install from ClawHub, which community skills deliver the most value by category, and how to author and publish your own. For the technical architecture that underpins how skills are loaded into the agent loop, see our guide on How OpenClaw Works: The Gateway, Agent Loop, Skills System, and Memory Architecture.

What Is a SKILL.md File?

An OpenClaw skill is a directory containing a SKILL.md file. That file has two parts: YAML frontmatter declaring metadata, and a markdown body with the actual instructions. The frontmatter covers the basics — name, description, version — plus any requirements the skill needs to run. The body acts as a runbook: what to do, what inputs to collect, how to handle failures, and what format to return.

OpenClaw uses a skills system in which skills are stored as directories containing a SKILL.md file with metadata and instructions for tool usage.

OpenClaw skills are almost suspiciously simple. A "skill" is a folder with a SKILL.md file — that's the hard requirement. No SDK, no compilation, no special runtime. All you need is YAML frontmatter plus markdown instructions that teach the agent a repeatable way to do something. That simplicity is the whole point.

The Anatomy of a SKILL.md

Skill metadata is declared in the YAML frontmatter at the top of your SKILL.md. This tells the registry — and security analysis — what your skill needs to run. A minimal valid skill looks like this:

---
name: my-skill
description: Short summary of what this skill does.
version: 1.0.0
metadata:
  openclaw:
    requires:
      env:
        - MY_API_KEY
      bins:
        - curl
    primaryEnv: MY_API_KEY
---

# My Skill Name

## Workflow
1. Collect the user's input.
2. Call the API using the declared credentials.
3. Format and return the result.

The metadata block declares what the skill needs: environment variables, binaries, and install commands for npm, Homebrew, or uv. OpenClaw checks these at load time and warns you if anything is missing.

The user-invocable field — true or false, defaulting to true — controls whether the skill is exposed as a user slash command. When disable-model-invocation is set to true, the skill is excluded from the model prompt but remains available via user invocation.

A critical design point: skills are operational instructions. A skill is not a plugin that executes code by itself — it tells the agent what to run and how to format output. That distinction matters for security.

How OpenClaw Injects Skills Into the Agent

By default, OpenClaw watches skill folders and bumps the skills snapshot when SKILL.md files change. When skills are eligible, OpenClaw injects a compact XML list of available skills into the system prompt.

The cost is deterministic: base overhead (only when one or more skills are present) is 195 characters; per skill, 97 characters plus the length of the XML-escaped name, description, and location values.

A rough OpenAI-style estimate is approximately 4 chars per token, so 97 chars equals roughly 24 tokens per skill plus your actual field lengths. This means a well-curated skill stack of 10–15 skills adds only a modest, predictable overhead to each agent turn.

OpenClaw snapshots the eligible skills when a session starts and reuses that list for subsequent turns in the same session. Changes to skills or config take effect on the next new session. Skills can also refresh mid-session when the skills watcher is enabled or when a new eligible remote node appears — think of this as a hot reload: the refreshed list is picked up on the next agent turn.

Bundled, Global, and Workspace-Scoped Skills

OpenClaw resolves skills from multiple locations with a clear precedence hierarchy. Understanding this hierarchy is essential for managing overrides and multi-agent configurations.

The precedence order is: <workspace>/skills (highest) → <workspace>/.agents/skills → ~/.agents/skills → ~/.openclaw/skills → bundled skills → skills.load.extraDirs (lowest).

Per-agent skills live in <workspace>/skills for that agent only. Project agent skills live in <workspace>/.agents/skills and apply to that workspace before the normal workspace skills folder. Personal agent skills live in ~/.agents/skills and apply across workspaces on that machine.

OpenClaw ships a baseline set of bundled skills as part of the install — via the npm package or OpenClaw.app. ~/.openclaw/skills exists for local overrides, for example pinning or patching a skill without changing the bundled copy. Workspace skills are user-owned and override both on name conflicts.

This layered design means a team can maintain shared skills in the global managed location, while individual agents carry specialised workspace-scoped skills tailored to specific projects — without any conflicts.

ClawHub: OpenClaw's Public Skill Registry

ClawHub is the public registry for OpenClaw skills and plugins. Think of it as the npm of AI agent capabilities: a versioned, searchable, community-driven library of things your agent can learn to do. One command to install, one command to update, and your agent gains a new ability without you writing a line of code.

ClawHub lets you browse, install, and publish skill packs. Skills are versioned like npm, searchable with vectors, with no gatekeeping.

OpenClaw's public registry (ClawHub) hosted 13,729 community-built skills as of February 28, 2026. After the ClawHavoc security incident in early 2026 — during which 341 malicious skills with typosquatted names distributed Atomic Stealer malware through ClawHub over three weeks — the registry underwent a significant purge. After the ClawHavoc cleanup that removed 2,419 suspicious skills, 3,286 remain. The community-curated awesome-openclaw-skills repository on GitHub filters these down to approximately 5,200 vetted, quality skills across 25 categories.

How to Browse and Search ClawHub

The ClawHub site lives at clawhub.ai. You can browse, search by keyword or tag, and read the full SKILL.md content for any skill before installing it. From the terminal, OpenClaw ships with native search built in.

openclaw skills search "calendar"
openclaw skills search "github pr review"
openclaw skills search "postgres"

The search is powered by vector embeddings, not keyword matching — so "email triage" will surface skills tagged for inbox management even if they don't use that exact phrase. This is a meaningful advantage over keyword-only registries: you can search by intent and discover adjacent skills you would not have known to look for.

How to Install a Skill

There are two installation paths:

Via the native OpenClaw CLI:

openclaw skills install <slug>

Native openclaw skills install installs into the active workspace skills directory.

Via the standalone ClawHub CLI:

clawhub install <slug>
clawhub install gog
clawhub install agent-browser

By default, the ClawHub CLI installs into ./skills under your current working directory. OpenClaw picks that up as <workspace>/skills on the next session.

You can also manage local installs with clawhub uninstall <slug>, clawhub list, and clawhub update --all; inspect without installing via clawhub inspect <slug>; and publish or sync skills with clawhub skill publish <path> and clawhub sync.

You can also paste the skill's GitHub repository link directly into your assistant's chat and ask it to use it. The assistant will handle the setup automatically in the background.

High-Value Community Skills by Category

Productivity and Google Workspace

GOG — Google Workspace CLI (clawhub install gog)

GOG has 14,000 downloads and 48 stars. It unifies Gmail, Calendar, Drive, Contacts, Sheets, and Docs into a single command-line interface. "Check my calendar for conflicts this week and draft a reschedule email" becomes one instruction. For founders who live in the Google ecosystem, this bridges communication and coding workflows.

GOG has long been the go-to Google Workspace skill on ClawHub. More recently, Google itself published an official Google Workspace CLI on GitHub containing guidelines for OpenClaw integration. The key difference: GOG is the simpler starting point for most users, while the CLI is worth switching to if you need deeper or more comprehensive Workspace access.

Daily Briefing / Mission Control

Mission Control aggregates task management, calendar events, and notification messages into a single morning briefing, acting as the "control tower" for your personal productivity.

Daily Briefing leads community popularity rankings by a wide margin. It compiles unread messages, calendar events, priorities, and weather into a single morning summary. Most users schedule it at 7 AM via Telegram.

Browser Control and Web Research

Agent Browser (clawhub install agent-browser)

Agent Browser is a browser automation skill that lets the agent navigate the web, fill forms, and extract data from dynamic pages.

It has 43 stars — the top-rated web skill on ClawHub.

Tavily (clawhub install framix-team/openclaw-tavily)

Tavily is a search engine specifically designed for AI agents. Unlike traditional search engines, it returns structured summary results directly, not just a list of links. The Tavily skill gives your OpenClaw agent access to tavily_search for fast AI-optimized web search, tavily_extract for pulling structured content from specific URLs, tavily_crawl for crawling websites, and tavily_research for multi-step research with source synthesis.

Developer Workflows

GitHub (clawhub install openclaw/github)

The GitHub skill is the single most important extension for any developer using OpenClaw. It gives your agent full access to your GitHub repositories, enabling it to clone repositories, create branches, switch between them, stage changes, write commit messages, and push code.

N8N Workflow Automation

This skill connects OpenClaw directly to your N8N instance, letting you spin up, manage, and trigger complex multi-step workflows using cron jobs and plain chat. The entire process runs locally, so data remains private.

Voice and Communication

ElevenLabs Agents

If your job requires AI calling services, this skill integrates directly with the ElevenLabs CLI, giving OpenClaw an actual voice and bridging the gap between text-based AI operations and real-world audio interactions. A notable feature is its fail-safe mechanism: if the bot fails to send a text message or email, it automatically pivots to making a real phone call instead.

Self-Improvement and Meta-Skills

Capability Evolver (clawhub install capability-evolver)

Capability Evolver tops the ClawHub charts with 35,000+ downloads. This is a meta-skill — it lets your OpenClaw agent analyse its own runtime history, identify failures or inefficiencies, and autonomously write new code or update its memory to improve performance. Think of it as giving your agent the ability to learn from its mistakes.

ClawHub's 3,286 active skills span categories including AI/ML (1,588 skills), utility (1,520), development (976), and productivity (822).

How to Build and Publish a Custom Skill

Building a custom skill requires no SDK, no compilation, and no special runtime. A skill is a folder with a SKILL.md file. No SDK, compilation, or special runtime is needed — just YAML frontmatter plus markdown instructions that teach the agent a repeatable way to do something.

Step-by-Step: Authoring a Custom Skill

Step 1: Create the skill directory

mkdir email-triage-weekly
cd email-triage-weekly

The folder name becomes the skill's slug on ClawHub, so it needs to follow the registry's naming rules: lowercase letters, numbers, and hyphens only, starting with a letter or number.

Step 2: Write the SKILL.md

Skill metadata is declared in the YAML frontmatter at the top of your SKILL.md. This tells the registry and security analysis what your skill needs to run. A strong description is the most important field: the description is the primary triggering mechanism for your skill, and helps the agent understand when to use it. Include both what the skill does and specific triggers or contexts for when to use it. Include all "when to use" information in the description — not in the body.

Most weak skills fail because the body reads like marketing copy. The agent needs a runbook with deterministic steps, stop conditions, and a clear output format. Write your skill body like a checklist you'd hand to an on-call engineer at 3 AM — not a product description.

Step 3: Add supporting files (optional)

A skill needs at minimum a SKILL.md. You can also include supporting files — for example, a Python script for PDF templating — giving the final structure a scripts/ subdirectory alongside SKILL.md.

Step 4: Test locally

OpenClaw's file watcher picks up changes to SKILL.md within 250ms, so you can edit the instructions and test again without restarting your agent session. Test with real, messy data — not synthetic examples. Synthetic test data hides problems. Test your skill with real meeting notes, real emails, real reports. The messy reality of actual data is where skills break.

Step 5: Publish to ClawHub

Install the ClawHub CLI and log in with your GitHub account (which must be at least one week old), then run clawhub publish ./your-skill --slug your-skill --version 1.0.0 --changelog "Initial release".

ClawHub's security analysis checks that what your skill declares matches what it actually does. If your code references an environment variable but your frontmatter doesn't declare it under requires.env, the analysis will flag a metadata mismatch. Keeping declarations accurate helps your skill pass review and helps users understand what they're installing.

ClawHub is open by default. Anyone can upload skills, but a GitHub account must be at least one week old to publish. This helps slow down abuse without blocking legitimate contributors.

Principles of High-Quality Skill Authorship

A skill that tries to do everything does nothing well. Build narrow skills that do one thing reliably, then compose them together for complex workflows.

Use semantic versioning in the frontmatter. When you update the instructions, bump the version. This helps users know which version they are running and whether an update is available.

From the community, the skills that earn adoption share common traits: clear, specific names; one-line descriptions that explain the value, not the mechanism; tags that match what users search for; and examples in the README that show real output.

Skill Security: What to Know Before You Install

The ClawHub registry's rapid growth attracted malicious actors early. Cisco's AI security research team tested a third-party OpenClaw skill and found it performed data exfiltration and prompt injection without user awareness, noting that the skill repository lacked adequate vetting to prevent malicious submissions.

Before installing or using any agent skill, review potential security risks and validate the source yourself. OpenClaw has a VirusTotal partnership that provides security scanning for skills — visit a skill's page on ClawHub and check the VirusTotal report to see if it's flagged as risky.

Every skill published to ClawHub now gets a SHA-256 hash that is checked against VirusTotal's database. If no match exists, the full skill ZIP is uploaded for analysis using Google's Gemini-powered Code Insight tool.

Practical vetting guidance from the community:

• Use the 100/3 rule: skills with 100+ downloads and 3+ months on ClawHub are safer.

• Start with read-only access. Let your agent summarise emails before you let it send them. Let it read your calendar before it books meetings. Build trust incrementally.

• Treat third-party skills as untrusted code. Read them before enabling. Prefer sandboxed runs for untrusted inputs and risky tools.

• If a skill for something simple (like checking the weather) asks for permission to run shell commands, that's a red flag.

• Security teams should establish mandatory standards for input validation and key management. For enterprise deployment, it is recommended to establish a private skill registry, combined with an approval workflow and version-pinning mechanism, to ensure production environment stability and compliance.

For a full treatment of the threat model — including prompt injection via skills, the ClawHavoc supply chain attack, and enterprise hardening — see our guide on OpenClaw Security Risks: Prompt Injection, Malicious Skills, and Safe Deployment Practices.

Key Takeaways

• Each OpenClaw skill is a directory containing a SKILL.md with YAML frontmatter and instructions — no SDK, no compilation, no special runtime required. The YAML frontmatter declares the skill's name, description, version, and runtime requirements (environment variables, binaries); the markdown body is the agent's operational runbook.

• OpenClaw resolves skills by precedence: workspace skills override project agent skills, which override personal agent skills, which override global managed skills, which override bundled skills. This hierarchy enables clean multi-agent setups with shared and per-agent skill stacks.

• ClawHub is the public registry for OpenClaw skills and plugins — the npm of AI agent capabilities: a versioned, searchable, community-driven library.

It hosted 13,729 community-built skills as of February 28, 2026.

• The most-downloaded skills by category are: Capability Evolver (35K downloads), Wacli (16K), ByteRover (16K), Self-Improving Agent (15K), GOG (14K), Agent Browser (11K), Summarize (10K), and GitHub (10K).

• Every skill published to ClawHub now receives a SHA-256 hash checked against VirusTotal, with full ZIP analysis via Google's Gemini-powered Code Insight tool for new submissions. Always read the SKILL.md before enabling any third-party skill in a production environment.

Conclusion

The OpenClaw Skills system and ClawHub registry together form the extensibility layer that transforms a locally-running agent runtime into an adaptable platform for virtually any automation use case. The shift happening in 2026 is clear: we are moving from one-shot prompting to persistent, composable agent behaviours — and skills are how you get there.

The investment in understanding SKILL.md structure, the precedence hierarchy, and ClawHub's installation patterns pays dividends immediately: a well-chosen skill stack of five to fifteen skills can automate email triage, calendar management, browser research, developer workflows, and API integrations with minimal configuration. And because skills are plain text files, they remain auditable, versionable, and fully under your control — a critical property for Australian businesses evaluating data sovereignty implications (see our guide on OpenClaw Managed Hosting in Australia: Data Sovereignty, Compliance, and Provider Options).

For those ready to go further, authoring a custom skill requires nothing more than a text editor and a clear understanding of the task you want to automate. The community has already demonstrated that narrow, well-written skills — those that do one thing reliably and compose cleanly with others — are the ones that earn adoption and stand the test of real-world, messy data.

References

• OpenClaw Project. "Skills." OpenClaw Official Documentation, 2026. https://docs.openclaw.ai/tools/skills

• OpenClaw Project. "ClawHub." OpenClaw GitHub Repository — docs/tools/skills.md, 2026. https://github.com/openclaw/openclaw/blob/main/docs/tools/skills.md

• OpenClaw Project. "ClawHub Skill Registry." GitHub — openclaw/clawhub, 2026. https://github.com/openclaw/clawhub

• OpenClaw Project. "ClawHub Skill Format." GitHub — openclaw/clawhub/docs/skill-format.md, 2026. https://github.com/openclaw/clawhub/blob/main/docs/skill-format.md

• VoltAgent. "Awesome OpenClaw Skills." GitHub — VoltAgent/awesome-openclaw-skills, 2026. https://github.com/VoltAgent/awesome-openclaw-skills

• Wikipedia Contributors. "OpenClaw." Wikipedia, 2026. https://en.wikipedia.org/wiki/OpenClaw

• DigitalOcean. "What are OpenClaw Skills? A 2026 Developer's Guide." DigitalOcean Resources, February 2026. https://www.digitalocean.com/resources/articles/what-are-openclaw-skills

• DataCamp. "Best ClawHub Skills: A Complete Guide." DataCamp Blog, March 2026. https://www.datacamp.com/blog/best-clawhub-skills

• Firecrawl. "16 Best OpenClaw Skills for Your AI Agents." Firecrawl Blog, March 2026. https://www.firecrawl.dev/blog/openclaw-skills

• LumaDock. "How to Build Custom OpenClaw Skills for Your Own Automations." LumaDock Tutorials, February 2026. https://lumadock.com/tutorials/build-custom-openclaw-skills

• OpenClaw Playbook. "ClawHub: The Skill Registry for OpenClaw Agents." OpenClaw Playbook Blog, 2026. https://www.openclawplaybook.ai/blog/clawhub-skill-registry-openclaw-agents/

• ClawOneClick. "ClawHub Top Skills 2026: Most Popular OpenClaw Skills List." ClawOneClick, 2026. https://clawoneclick.com/en/blog/clawhub-top-skills-2026

• Mak, Ewan. "The Best ClawHub Skills Worth Installing Now: A Category-by-Category Guide." Medium, March 2026. https://medium.com/@tentenco/the-best-clawhub-skills-worth-installing-now-a-category-by-category-guide-5221c4850d21

• KDnuggets. "OpenClaw Explained: The Free AI Agent Tool Going Viral Already in 2026." KDnuggets, March 2026. https://www.kdnuggets.com/openclaw-explained-the-free-ai-agent-tool-going-viral-already-in-2026