Thousands of skills, one open registry, and a malware campaign that hit 341 of them. Here's how to navigate ClawHub without becoming a statistic. Updated October 7, 2026: current install commands, the VirusTotal scanning details, and corrected audit figures.
I found the perfect Notion integration skill on ClawHub last month. Clean description. Recent updates. 3,200+ downloads. I installed it, connected my workspace, and watched my OpenClaw agent sync tasks from Telegram directly into Notion boards.
Two days later, I noticed API requests on my Anthropic dashboard that I hadn't made. Someone was using my key. The skill had been reading my config file and sending credentials to an external server while functioning exactly as advertised.
That is the risk with any open registry, and ClawHub learned it at scale. In early February 2026, Koi Security audited all 2,857 skills on ClawHub and found 341 malicious ones. 335 of them belonged to a single campaign, now called ClawHavoc, that used fake "prerequisites" to get users to install the Atomic Stealer (AMOS) infostealer on macOS. Days later, on February 7, OpenClaw announced a VirusTotal partnership to scan every skill published to ClawHub.
This guide covers everything you need to know about the ClawHub skills directory in 2026: what's available, what's dangerous, how to find good skills, and how to protect yourself from bad ones.
What ClawHub actually is (and isn't)
ClawHub is the official skill registry for OpenClaw. Think of it like npm for Node.js packages or PyPI for Python libraries, except the packages add capabilities to your AI agent instead of your codebase.
Skills are what turn OpenClaw from a chatbot into an agent. Without skills, your agent can only have conversations. With skills, it can search the web, manage your calendar, read and write files, automate browser tasks, send emails, interact with APIs, and execute shell commands.
ClawHub had 2,857 skills when Koi audited it in early February 2026, and it has grown fast since, so check clawhub.ai for the current count. A community-curated list on GitHub, awesome-openclaw-skills, filters that registry down to a smaller set with basic quality annotations.
What ClawHub is: An open registry where anyone can publish a skill package. Think app store with minimal review.
What ClawHub isn't: A curated, security-reviewed marketplace. Until the VirusTotal partnership, there was effectively no automated security scanning. Publishers could upload anything, and in Koi's audit roughly 12% of the registry was malicious.
For the full timeline of documented OpenClaw security incidents including the ClawHavoc campaign, CrowdStrike advisory, and Cisco's data exfiltration discovery, our security guide covers each event.
The ClawHub skills categories worth knowing
The directory organizes skills into categories, though the boundaries are loose and many skills span multiple categories. Here's what's available and what's useful.
Communication skills
These connect your agent to external messaging and communication tools. Email reading and drafting (Gmail, Outlook), calendar management (Google Calendar, CalDAV), messaging integrations beyond the platforms OpenClaw already supports natively, and notification routing.
The risk level is high. Communication skills need access to your email, calendar, or messaging accounts. A compromised email skill can read every message in your inbox and forward copies to an external server. The Meta researcher Summer Yue incident is the cautionary tale here: her agent mass-deleted emails while ignoring stop commands. Even legitimate email skills need strict permission boundaries.
Search and research skills
Web search (Brave API, Google Custom Search, Tavily), academic paper search, news aggregation, and data retrieval from specific sources. These are among the most commonly installed skills because they give your agent access to real-time information.
The risk level is moderate. Search skills make outbound API calls to retrieve information. The main concern is whether they're sending your query data (which might contain sensitive context from your conversations) to unexpected destinations alongside the legitimate search requests.
Productivity skills
File management, note-taking integrations (Notion, Obsidian), project management connections (Linear, Asana, Jira), and document processing. These skills let your agent interact with your work tools.
The risk level is moderate to high. Productivity skills typically need OAuth tokens or API keys for external services. A compromised productivity skill has access to whatever tools it connects to.
Developer tools
Code execution, Git operations, CI/CD integrations, database queries, and API testing. These are popular among developers who use OpenClaw as a coding assistant.
The risk level is very high. Developer tool skills often have shell access or can execute arbitrary code. A malicious developer skill with shell access can do anything on your machine. Cisco's discovery of a skill quietly exfiltrating data shows how far a skill with broad access can go.
How to find good skills on ClawHub
The ClawHub interface shows skill name, description, publisher, download count, last update date, and version history. Here's how to use that information to filter for quality.
Publisher reputation matters most
Skills published by OpenClaw's own maintainers are the safest starting point. Several of the most-installed skills, including GitHub, Notion, Slack and Obsidian, come from @steipete, the account of OpenClaw's creator.
After official skills, established community developers with multiple published packages, active GitHub profiles, and real identities are the next safest tier. A publisher who has maintained three skills for six months with regular updates is very different from an account created last week with one package.
Red flags on publishers: Account created recently with only one skill. Username that mimics official accounts (like "opencIaw" with a capital I instead of lowercase L). No GitHub profile linked. Generic or AI-generated skill descriptions.
Download count needs context
High download count alone doesn't mean safe. ClawHavoc skills posed as popular tools (crypto wallets, Polymarket bots, YouTube utilities, Google Workspace integrations) and leaned on typosquatted names to collect installs. Download count tells you popularity, not quality.
What matters more: the ratio of downloads to the skill's age. A skill published last week with 5,000 downloads either went viral organically (rare) or had its count artificially boosted (more common). A skill published six months ago with 5,000 downloads grew naturally through genuine adoption.
Last update date signals maintenance
Skills that haven't been updated in more than three months are concerning. OpenClaw releases multiple updates per week. Skills that don't keep up with the framework eventually break or develop compatibility issues.
The sweet spot: skills updated within the last 30-60 days with a consistent version history showing incremental improvements rather than a single large dump of code.
For our curated list of the best community-vetted OpenClaw skills that have passed security review, our skills guide ranks options by reliability, safety, and usefulness.
The 5-step vetting process before you install anything
Finding a skill on ClawHub is step one. Vetting it before installation is what separates safe users from compromised ones.
Step 1: Check the publisher. Verify their identity, account age, and other published packages. Official skills from the core team are safest.
Step 2: Read the skill itself. A skill is a folder with a SKILL.md file of instructions for your agent, plus any scripts it ships. Read the SKILL.md first: ClawHavoc skills hid their payload in "prerequisites" that told you (or your agent) to download and run something. Then check any scripts for network calls to unexpected domains, reads of your config file where API keys live, obfuscated code, and environment variable access beyond what's needed.
Step 3: Search community reports. Check GitHub issues and the OpenClaw Discord for the skill name. If others have reported problems, you'll find them.
Step 4: Test in a sandboxed workspace. Never install a new skill directly into your production agent. Create a test workspace, install the skill there, run it for 24-48 hours, and monitor your API usage dashboards for unexpected activity.
Step 5: Contain it. Keep exec approvals on so the agent asks before running shell commands, install into a single agent with --agent <id> rather than globally, and re-check the skill after every update with openclaw skills verify @owner/slug.
The vetting process takes 5-10 minutes per skill plus a 24-hour monitoring window. That's 5-10 minutes compared to hours of damage control if something goes wrong. The numbers are obvious. BetterClaw runs this kind of check by hand before a skill reaches its library: the 4-layer skill security review covers malicious code analysis, exfiltration testing, prompt injection scanning and a permission audit.
What changed after ClawHavoc
The ClawHavoc campaign was a wake-up call for the entire ecosystem. Here's what ClawHub has done since, and what's still missing.
What improved
VirusTotal scanning. Every skill published to ClawHub is hashed and checked against VirusTotal, then analysed with VirusTotal Code Insight. A "benign" verdict is approved automatically, a "suspicious" one gets a warning on the listing, and a "malicious" one is blocked from download. All active skills are re-scanned daily, so a skill that turns bad after an update gets caught.
Owner-scoped installs. Popular names now exist under several publishers, so ClawHub refuses an ambiguous bare slug and asks you to name the owner: openclaw skills install @owner/slug. That makes a typosquat harder to install by accident, as long as you check the owner.
Install checks in OpenClaw. OpenClaw checks ClawHub installs against your install policy, warns before installing a flagged skill, and openclaw skills verify @owner/slug re-checks an installed skill against ClawHub.
What's still missing
Mandatory human review. No person reviews a skill before it goes live. OpenClaw's own announcement is blunt about the gap: a skill that uses natural language to instruct an agent to do something malicious won't trigger a virus signature, and a carefully crafted prompt injection payload won't show up in a threat database.
Permission scoping. Skills currently have access to whatever OpenClaw has access to. There's no granular permission system where a calendar skill can only access calendar APIs, not your file system. This means every skill is either trusted with everything or not installed at all.
Dependency auditing. Scripts inside a skill can pull in their own packages, and those can pull in more. The supply chain attack surface extends well beyond the SKILL.md you read.
If managing skill security, vetting, and permission boundaries sounds like more work than you want, BetterClaw's curated skill marketplace audits every skill before publication. Docker-sandboxed execution means even a compromised skill can't access your host system or credentials. $49/month for Pro, BYOK. Zero unvetted code running on your infrastructure.
The alternative registries worth knowing
ClawHub isn't the only place to find OpenClaw skills. Two alternatives are worth mentioning.
awesome-openclaw-skills (GitHub)
A community-curated list that filters ClawHub down to a smaller set with basic quality annotations. It's not a registry (you still install skills from ClawHub or GitHub). It's a curation layer that filters the noise. The maintainers remove skills that are reported as malicious or abandoned. It's not a security guarantee, but it's a better starting point than browsing ClawHub's unfiltered listing.
Direct GitHub installation
You can install skills directly from GitHub repositories without going through ClawHub at all. Clone the repo, review the code, and copy it into your OpenClaw skills directory. This bypasses ClawHub entirely and gives you complete visibility into what you're installing.
The trade-off: updates are on you. When the skill author pushes a new version, you pull and review the changes yourself. With ClawHub installs, updating is one command, which is both convenient and risky: an update can introduce code that wasn't in the version you vetted, so re-run openclaw skills verify after updating.
For guidance on the full OpenClaw installation and skill configuration process, our setup guide covers where skills fit into the deployment sequence.
The skills most people should start with
After reviewing the ecosystem extensively, here are the skill categories that provide the most value with the least risk for new OpenClaw users.
Web search. A Tavily or Brave Search skill. Essential for any agent that needs to look up information, and lower risk because it only makes outbound search queries. Our ranked list of the best OpenClaw skills has the exact owner-scoped install commands and each skill's ClawHub scan verdict.
File operations. OpenClaw's built-in file read/write capabilities handle most basic file tasks without requiring an external skill. Start with the native tools before adding third-party file management skills.
Calendar. Google Calendar or CalDAV integrations from verified publishers with established track records. These need OAuth access to your calendar, so choose carefully. Only install from publishers with real identities.
Custom internal skills. If you need your agent to interact with a proprietary API (your Shopify store, your CRM, your internal tools), building a custom OpenClaw skill is safer than finding a generic one on ClawHub. You control every line of code. For ecommerce-specific agent configurations, our ecommerce guide covers the most common integrations.
Email (with extreme caution). Email skills are the highest-risk category. Start with read-only access. Only enable send with explicit confirmation requirements. Never give an agent unsupervised email send permissions. The Summer Yue incident is the permanent reminder of why.
What to do if you've already installed unvetted skills
If you've been installing ClawHub skills without vetting them (most people have in the beginning), here's the damage control sequence.
First: rotate all API keys immediately. Every key in your OpenClaw config. Anthropic, OpenAI, Telegram bot tokens, OAuth credentials. All of them. If any skill has exfiltrated your keys, rotating them invalidates the stolen copies.
Second: review your API usage dashboards. Check the last 30 days for requests you didn't make. Unusual patterns (requests at odd hours, high-volume calls you don't recognize) indicate compromise.
Third: audit every installed skill. List everything your agent currently has installed. For each skill, run through the 5-step vetting process. Remove anything that doesn't pass.
Fourth: set up monitoring going forward. Check API usage weekly. Review logs after installing any new skill. Set spending caps on all provider accounts.
The managed vs self-hosted security comparison covers how platforms like BetterClaw handle skill security versus what you're responsible for when self-hosting.
The bigger picture: where the ClawHub ecosystem is heading
The skills ecosystem is at an inflection point. The ClawHavoc campaign forced the community to take supply chain security seriously. VirusTotal scanning and the publisher verification system are steps in the right direction. But the fundamental challenge remains: an open registry with minimal review will always have a security tail risk.
The likely evolution is a tiered system. A "verified" tier with mandatory code review and publisher identity verification. An "unverified" tier with automated scanning only. And eventually, permission scoping that limits what each skill can access regardless of trust level.
Until that happens, the responsibility is on you. Every skill you install is executable code running with your agent's permissions and access to your API keys. Treat ClawHub like you'd treat any package registry: with appreciation for the ecosystem and suspicion toward anything you haven't personally reviewed.
If you want a deployment where skills are security-audited before they reach your agent, where Docker sandboxing prevents compromised code from accessing your host system, and where you don't carry the vetting burden yourself, give BetterClaw a try. $49/month for Pro, BYOK. Every skill in our marketplace is reviewed. Sandboxed execution means even a problematic skill can't reach beyond its container. You build workflows. We handle the security.
Frequently Asked Questions
What is ClawHub?
ClawHub is the official skill registry for OpenClaw. Skills add capabilities to your OpenClaw agent: web search, calendar management, email, file operations, browser automation, and API integrations. ClawHub works like npm or PyPI for AI agent capabilities. Anyone can publish, and since February 2026 every skill is scanned with VirusTotal and re-scanned daily. It had 2,857 skills at the time of Koi Security's February audit and has grown fast since; check clawhub.ai for the current count.
How does ClawHub compare to awesome-openclaw-skills?
ClawHub is the official registry with the largest collection and one-command installs and updates, but it's an open marketplace with no human review. awesome-openclaw-skills is a community-curated GitHub list that filters ClawHub down to a smaller set with basic quality filtering and maintainer oversight. Neither is a security guarantee. ClawHub has more skills and convenience. awesome-openclaw-skills has better curation. Use both as discovery tools, but always vet skills yourself before installation.
How do I install skills from ClawHub safely?
Follow a 5-step process: check the publisher's identity and account history, read the source code for suspicious network calls and file access patterns, search community reports on GitHub and Discord, test in a sandboxed workspace for 24-48 hours while monitoring API usage, then install with the owner-scoped command (openclaw skills install @owner/slug) and keep exec approvals on. The active vetting takes 5-10 minutes per skill plus a 24-hour monitoring window.
How much do ClawHub skills cost to use?
Skills themselves are free to install from ClawHub. The cost comes from the API tokens they consume when your agent uses them. A web search skill adds roughly 1,000-3,000 tokens per search call. Browser automation can use 500-2,000 tokens per step. On Claude Sonnet 5.5 ($2/$10 per million tokens), typical skill usage adds a few dollars to $15 a month to your API bill depending on frequency. Turn on loop detection to stop runaway costs from skills that repeat the same tool call.
Are ClawHub skills secure enough for business use?
Not without vetting. Koi Security's February 2026 audit found 341 malicious skills out of 2,857 (about 12% of the registry), 335 of them from the ClawHavoc campaign. ClawHub has since added VirusTotal scanning with daily re-scans, but OpenClaw itself says automated detection won't catch prompt injection written in plain language. Cisco independently found a legitimate-looking skill performing data exfiltration. For business use, either vet every skill manually using the 5-step process, use a managed platform with a curated skill marketplace (like BetterClaw), or build custom skills for sensitive integrations.
