How to Find, Browse, and Manage OpenClaw Skills

In February 2026, security firm Koi Security audited 2,857 skills on ClawHub and flagged 341 of them as malicious, roughly 12% of the public registry at the time. The payloads included Atomic Stealer for macOS and trojans with keylogging capabilities, all disguised as productivity utilities like cryptocurrency trackers and YouTube downloaders. That finding, published as the ClawHavoc report, reframed how developers should think about skill discovery. "Browse and install" is not a workflow. You need listing, searching, verification, and auditing before any skill touches your agent.

OpenClaw skills are packaged capabilities that extend what an agent can do. A skill might handle API calls, database queries, code generation, file processing, or workflow automation. Skills range from single-purpose utilities to complex multi-step pipelines, and they can be shared, versioned, and composed together.

The ecosystem splits into three tiers. The OpenClaw core team maintains 53 built-in skills that ship with every install. These undergo code review, follow the official sandboxing specification, and carry a published changelog. Beyond those, ClawHub hosts over 13,000 community-published skills in an open registry where anyone with a GitHub account can publish. Finally, teams can install private skills from Git repositories or local directories for proprietary workflows.

The gap between 53 vetted skills and 13,000+ unvetted ones is where the risk concentrates. The VoltAgent/awesome-openclaw-skills project on GitHub curates 5,400+ skills filtered by community adoption, but curation and security auditing are not the same thing.

OpenClaw's built-in skill listing command shows every skill available in your current environment. By default, it displays the skill name, status, and source (built-in, managed, or workspace). Add flags to customize the output:

openclaw skills list
openclaw skills list --verbose
openclaw skills list --eligible
openclaw skills list --json

The --verbose flag adds version numbers, installation paths, and permission requirements. --eligible filters to skills with all dependencies resolved. --json outputs machine-readable format for scripting and automation pipelines.

Status indicators tell you whether a skill is ready to use:

• ready: All binaries, environment variables, and configurations are present. The skill will run when invoked.

• missing: A required dependency is absent. Run openclaw skills check to identify what needs installing.

To find skills beyond your local install, use openclaw skills search:

openclaw skills search "calendar"
openclaw skills search --limit 20 --json

This queries the ClawHub registry by keyword. Results include the skill name, author, download count, and a short description. For deeper detail about a specific skill before installing, use openclaw skills info:

openclaw skills info <skill-name>

This returns the skill's full description, author profile, version history, permission requirements, and download statistics. Think of it as the first checkpoint in any audit workflow. If the permissions list looks excessive for what the skill claims to do, that is your signal to dig deeper before proceeding.

The CLI search works well for targeted lookups when you know roughly what you want. ClawHub's web interface gives you a broader view of the ecosystem. The registry supports vector search, so you can describe what you need in natural language rather than guessing exact keywords. Searching "send a weekly email summary of project changes" returns different results than searching "email automation."

For a curated starting point, the VoltAgent/awesome-openclaw-skills repository on GitHub organizes 5,400+ skills into categories including DevOps and Cloud, Productivity and Tasks, Browser and Automation, PDF and Documents, and Self-hosted and Automation. Each category lists skills with demonstrated community adoption, filtering out abandoned or low-quality entries.

Two things to keep in mind when browsing. First, curation is not verification. A popular skill can still exfiltrate data. The awesome-openclaw-skills maintainers note that listed skills "may be updated, modified, or replaced by their original maintainers at any time after being added." Second, ClawHub's open-by-default model means the registry grows faster than anyone can review it. When the initial Koi Security audit covered 2,857 skills, that was a fraction of the total registry. By the time they revisited the marketplace at 10,700+ skills, the number of identified malicious entries had risen to 824.

OpenClaw does partner with VirusTotal to provide automated security scanning for published skills. Visit any skill's ClawHub page and check the VirusTotal report to see whether it has been flagged. This catches known malware signatures, though it will not detect novel prompt injection techniques or subtle data exfiltration patterns baked into the skill's instructions.

The ClawHavoc campaign showed that reputation alone offers no protection. Of the 341 malicious skills Koi Security found, 335 were part of a single coordinated attack. A separate Snyk audit of 3,984 skills across OpenClaw and related registries found that 36.82% had at least one security flaw and 13.4% carried critical-level issues, including 76 confirmed malicious payloads.

Before installing any community skill, run through this checklist:

1. Check the publisher. Look at the GitHub account behind the skill. How old is it? Does it maintain other repositories with real activity? A week-old account publishing a "crypto portfolio tracker" is a signal worth investigating before you proceed.

2. Verify against the registry. Run openclaw skills verify <slug> to check the skill's integrity against ClawHub. The --card flag produces a formatted Skill Card showing version, checksum, and publisher details:

openclaw skills verify my-calendar-sync --card

3. Review permissions. Use openclaw skills info <name> to see what access the skill requests. A calendar integration that asks for filesystem write access to arbitrary directories should raise questions. Accept only the minimum required for the skill's stated purpose.

4. Check VirusTotal. Visit the skill's ClawHub page and review the automated scan report before downloading. This catches known malware signatures but not everything.

5. Test in isolation. Install new skills in a sandbox workspace and run them with minimal permissions. Monitor for unexpected network calls, file writes outside the expected scope, or attempts to read environment variables the skill should not need.

Treat every unverified ClawHub skill the way you would treat an npm package from an unknown author: read the source, check the permissions, and contain the blast radius until you have confidence in it.

Keep your OpenClaw skill outputs persistent and searchable

Fast.io gives agents 50GB of free storage with semantic search and audit logs. No credit card, no trial, no expiration.

Sign Up Free

Once a skill passes your audit, install it from ClawHub:

openclaw skills install <slug>

The CLI pulls the skill and places it in your managed skills directory at ~/.openclaw/skills. Several install variants handle different scenarios:

• openclaw skills install git:owner/repo pulls directly from a Git repository, useful for private or pre-release skills.
• openclaw skills install git:owner/repo@main targets a specific branch.
• openclaw skills install ./path/to/skill --as custom-name installs a local skill directory with a custom identifier.
• openclaw skills install <slug> --global places the skill in the shared managed directory.
• openclaw skills install <slug> --force overwrites an existing installation of the same skill.

OpenClaw loads skills from three locations, checked in this order:

1. Workspace skills (highest priority): Skills in the current project directory. These override managed and built-in skills with the same name, letting you customize behavior per project without modifying your global install.
2. Managed skills: Installed to ~/.openclaw/skills via the CLI. Available across all projects unless overridden by a workspace skill.
3. Bundled skills (lowest priority): The 53 built-in skills that ship with every OpenClaw install.

To keep your skills current, run:

openclaw skills update --all

This checks for new versions of every tracked skill and applies updates. For a single skill, pass the slug directly: openclaw skills update <slug>.

When something breaks after an update, openclaw skills check runs diagnostics across all installed skills, verifying that required binaries, environment variables, and configuration files are present and functional. Add --json for machine-readable output you can pipe into monitoring or alerting tools.

The Skill Workshop system lets teams propose new skills before committing to a full build:

openclaw skills workshop propose-create --name "qa-check" --description "Run automated QA checks"
openclaw skills workshop list
openclaw skills workshop apply <proposal-id>

This is useful for standardizing on a shared skill set across a team, letting everyone review proposals before they become active.

Skills generate artifacts: reports, processed datasets, code files, analysis results. By default, these land in local directories tied to one machine and one session. For solo experiments, local storage works fine. For teams where multiple agents and humans need access to the same outputs, you need persistent, shared storage with search and access controls.

Several options handle persistence at different levels. A shared S3 bucket or Google Cloud Storage gives you durability and versioning, but no built-in search across file contents and no collaboration features beyond IAM policies. Google Drive and Dropbox add sharing and previews, but lack the agent-native tooling that lets OpenClaw skills write directly to a shared workspace without manual upload steps.

Agent-oriented platforms like Fast.io bridge both gaps. Files persist across sessions, semantic search finds content by meaning rather than filename, and audit logs track every read and write. Fast.io works alongside OpenClaw through a ClawHub skill, giving agents MCP tools for uploading skill outputs, organizing files into workspaces, and handing results to human collaborators.

Intelligence Mode auto-indexes uploaded files for RAG queries. Instead of grepping through local directories to find what a skill produced last Tuesday, you can ask a question like "which skills generated error reports this week?" and get cited answers. Workspace-level permissions and file locks prevent conflicts when multiple agents write concurrently, and ownership transfer lets an agent build out a workspace and hand it to a client or team lead while keeping admin access.

The free agent plan includes 50GB of storage, 5,000 credits per month, and 5 workspaces. No credit card, no trial, no expiration.