Skills & Plugins

The most common question new OpenClaw users ask is: "What's the difference between a Skill, a Plugin, and a Tool?" They sound interchangeable, but they operate at completely different layers. Understanding this distinction is the key to extending your agent effectively.

The Three Layers

OpenClaw's extensibility is built on three layers that work together in a clear chain:

The chain flows like this:

Plugin → can ship its own Skills → Skills teach the agent to use Tools → Tools execute actions

Tools: The Foundation

Tools are the 26 built-in capabilities that let your agent interact with the world. Every tool is risk-tiered:

• Safe — Read-only operations like read, web_search, list_directory
• Medium — Write operations like write, edit, browser
• High — Unrestricted execution like exec, shell

You control which tools your agent can access via the tools.allow configuration in openclaw.json. If you only need your agent to search the web and read files, don't give it exec.

Skills: The Intelligence Layer

Skills are the most misunderstood part. A skill is not code. It is a structured document (SKILL.md) with YAML front-matter that gets loaded into the agent's system prompt. It teaches the agent how to accomplish a task using the tools it already has.

For example, the github skill doesn't contain any GitHub API code. Instead, it contains detailed instructions telling the agent how to use the exec tool to run gh CLI commands for creating PRs, reviewing code, and managing issues.

Skills use progressive disclosure — the agent only loads relevant skill instructions when they match the current conversation, keeping context windows efficient.

Plugins: The Platform Layer

Plugins are actual runtime code that extends OpenClaw at the system level. There are four types:

• Channel plugins — Connect new messaging platforms (Telegram, Discord, Slack, WhatsApp)
• Memory plugins — Add persistent memory backends (vector stores, databases)
• Tool plugins — Register entirely new tool capabilities beyond the 26 built-in ones
• Provider plugins — Add custom LLM providers

Most users never need to write a plugin. Skills and the built-in tools cover the vast majority of use cases.

Built-in Skills Worth Knowing

OpenClaw bundles 53 skills out of the box. Here are the ones people actually use:

Development

AI and Generation

Communication

Productivity

Smart Home and Media

Utilities

The ClawHub Ecosystem

Beyond the 53 bundled skills, ClawHub is the community marketplace with over 13,700 skills. The most popular ones have massive adoption:

• Web browsing — 180,000+ installs
• Telegram integration — 145,000+ installs

Skills on ClawHub are organized into categories: AI/ML, Utility, Development, Productivity, Web, Science, Media, Social, and Finance.

Finding Quality Skills

With 13,700+ skills, quality varies dramatically. Here's how to find good ones:

MCP Tools

OpenClaw has native support for the Model Context Protocol (MCP), which lets you connect external tool servers to your agent. This is particularly useful for integrating with services that don't have a dedicated OpenClaw skill.

Configuration goes in the mcpServers section of openclaw.json:

{
  "mcpServers": {
    "google-drive": {
      "command": "npx",
      "args": ["-y", "@anthropic/mcp-google-drive"]
    }
  }
}

There are over 1,000 community MCP servers available, covering Google Drive, Slack, databases (PostgreSQL, MongoDB), cloud platforms (AWS, GCP, Azure), and more. Each MCP server exposes its own set of tools that your agent can call directly.

Security: The ClawHavoc Incident

In January–February 2026, the OpenClaw community experienced ClawHavoc — a coordinated supply-chain attack through malicious skills on ClawHub. This is not theoretical; it happened.

What Happened

Across 12 publisher accounts, attackers uploaded 1,184 malicious skills that contained:

• Reverse shells — giving attackers remote access to the host machine
• Data exfiltration — silently uploading files, credentials, and environment variables
• AMOS stealer — macOS-specific malware targeting browser passwords and crypto wallets
• Persistent infection via MEMORY.md — injecting instructions into the agent's persistent memory so the malicious behavior survived skill removal

The Response

OpenClaw partnered with VirusTotal and removed over 2,400 suspicious skills. Publisher verification was introduced so users can distinguish vetted publishers from anonymous uploads.

However, a subsequent Snyk audit found that 36% of ClawHub skills still contain some form of prompt injection. VirusTotal catches binary malware and known attack patterns but cannot detect natural-language prompt injection — instructions hidden within a skill that manipulate the agent's behavior subtly.

How to Stay Safe

These practices are not optional if you use community skills:

1. Audit every unverified skill before installing. Read the SKILL.md file. It's a text document — this takes minutes, not hours.
2. Use allowBundled to whitelist only the skills you need. Don't load all 53 bundled skills if you only use 5.
3. Pin skill versions. Don't auto-update community skills. Review changelogs before upgrading.
4. Run openclaw security audit regularly. This scans installed skills for known malicious patterns.
5. Minimize tools.allow. If your agent doesn't need shell access, don't grant exec. The blast radius of a compromised skill is limited to the tools the agent can access.

Managing Skills on Claw Buff

On Claw Buff, skill management is handled through the Console rather than editing openclaw.json by hand.

Enable and disable skills — Each installed skill has a toggle in the Console's Agent section. Disabled skills are not loaded into the agent's context.

Configure API keys — Skills that need external service credentials (like spotify-player or notion) have inline configuration fields where you can set the required environment variables.

Browse and install from ClawHub — You can search and install ClawHub skills directly from the Console without SSH access to the container.

Binary dependencies — Some skills require external binaries (like ffmpeg for media processing or gh for GitHub). If a skill needs a binary that isn't pre-installed in the container, you'll see a dependency notice during installation. Contact support if you need additional system packages.