Security-Audited OpenClaw Skills
ClawHub has 13,700+ community skills. Independent audits found 13.4% with critical issues. 373 were actively malicious. 2,400 were removed in the ClawHavoc cleanup.
BetterClaw's marketplace has 200+ skills. Every one has been manually reviewed for malicious code, data exfiltration, and prompt injection. One-click install. Pre-configured permissions. Zero guesswork.
The Problem With 13,700 Unvetted Skills
OpenClaw's ClawHub registry is one of the most impressive community ecosystems in open source. Thousands of developers have built skills for everything from Google Workspace integration to browser automation to smart home control. The creativity is remarkable.
The security is terrifying.
A Snyk audit flagged 13.4% of ClawHub skills for critical security issues. A separate Koi Security scan of 2,857 skills found 341 actively stealing user data. The ClawHavoc attack in early 2026 used hundreds of malicious skills disguised under names similar to legitimate tools, establishing reverse shells and exfiltrating SSH keys, API tokens, and browser cookies. ClawHub removed 2,400+ skills and added VirusTotal scanning in response.
VirusTotal catches known malware signatures. It doesn't catch a skill that's well-written but designed to read your emails, copy your API keys, or inject prompts into your agent's context. Cisco's security team confirmed exactly this kind of sophisticated exfiltration in ClawHub skills.
BetterClaw's marketplace exists because most people can't review source code themselves and shouldn't have to. Every skill in our marketplace has passed a 4-layer manual security review before publication. The library is smaller (200+ vs 13,700+). The tradeoff is intentional.
Browse by Category
Productivity & Workspace
30-40 skills
Google Workspace, Notion, Obsidian, Calendar, Task Management, Daily Briefings, Summarization
Communication & Messaging
20-25 skills
Gmail, Slack, Discord, Microsoft Teams, WhatsApp, Telegram, Signal, iMessage, Email Management
Development & DevOps
30-40 skills
GitHub, GitLab, Docker, Vercel, Linear, Jira, Cursor CLI, Terminal, CI/CD, Code Review
Research & Web
15-20 skills
Web Browsing, Tavily Search, Exa Search, Academic Research, Content Extraction, Web Scraping
Business & Operations
20-25 skills
CRM (Salesforce, HubSpot, Pipedrive), Lead Qualification, Invoice Processing, Stripe, Shopify
Workflow Automation
15-20 skills
n8n, Zapier/Make Triggers, Webhook Management, Cron Scheduling, Multi-Agent Orchestration
Security & Monitoring
10-15 skills
Security Auditor, Permission Scanner, API Key Rotation, Activity Logger, Anomaly Detection
Content Creation
15-20 skills
Blog Writer, Social Media Scheduler, Image Generation, Video Summarizer, SEO Analyzer
Smart Home & IoT
10-15 skills
Home Assistant, Spotify, Weather, Smart Thermostat, Location Triggers, Smart Locks
HR & Recruiting
10-15 skills
Resume Screener, Interview Scheduler, Candidate Communication, Onboarding, Application Tracker
Finance & Accounting
10-15 skills
Expense Tracker, Invoice Generator, Stripe Integration, Budget Monitor, Subscription Tracker
Most Popular Audited Skills
Web Browsing
Research
Navigate pages, extract content, follow links. Foundation for all research and monitoring workflows.
180K+ downloads
SpecialistNotion
Productivity
Pages, databases, project boards, documentation. Your second brain, agent-accessible.
20K+ downloads
SpecialistSelf-Improving Agent
Productivity
Logs errors and learnings for continuous improvement. Most-downloaded skill on ClawHub.
181K+ downloads
LeadDownload counts from ClawHub's public registry. All skills above have passed BetterClaw's 4-layer security review. For the full list, see our curated guide.
How BetterClaw Skills Work
Browse the Marketplace
Search by category, capability, or keyword. Every skill shows its security review status, required permissions, recommended trust level, and compatible platforms.
One-Click Install
No CLI commands. No config files. No YAML. Click "Add to Agent" and the skill is installed, configured with recommended permissions, and ready to use.
Controlled by Trust Levels
Skills inherit your agent's trust level. An Intern-level agent asks approval before any skill takes a sensitive action. A Specialist handles routine actions independently.
BetterClaw Marketplace vs ClawHub
The tradeoff is explicit: ClawHub has 65x more skills. BetterClaw has 0% critical issues. We chose safety over size, because one malicious skill can compromise your entire agent's access to email, calendar, files, and API keys.
 BetterClaw | ClawHub | |
|---|---|---|
| Total Skills | 200+ | 13,700+ |
| Security Review | 4-layer manual audit (every skill) | VirusTotal scanning (known signatures only) |
| Malicious Skills Found | 0 (rejected before publication) | 373+ identified, 2,400+ removed |
| Critical Issue Rate | 0% (all reviewed) | 13.4% (Snyk audit) |
| Installation | One-click from dashboard | CLI command + manual config |
| Permission Scoping | Pre-configured per skill | User's responsibility |
| Trust Level Integration | Built-in (Intern/Specialist/Lead) | Not available |
| Skill Updates | Managed, re-reviewed | User pulls manually |
| Exfiltration Risk | Reviewed for every skill | Confirmed by Cisco |
Total Skills
BetterClaw
200+
ClawHub
13,700+
Security Review
BetterClaw
4-layer manual audit (every skill)
ClawHub
VirusTotal scanning (known signatures only)
Malicious Skills Found
BetterClaw
0 (rejected before publication)
ClawHub
373+ identified, 2,400+ removed
Critical Issue Rate
BetterClaw
0% (all reviewed)
ClawHub
13.4% (Snyk audit)
Installation
BetterClaw
One-click from dashboard
ClawHub
CLI command + manual config
Permission Scoping
BetterClaw
Pre-configured per skill
ClawHub
User's responsibility
Trust Level Integration
BetterClaw
Built-in (Intern/Specialist/Lead)
ClawHub
Not available
Skill Updates
BetterClaw
Managed, re-reviewed
ClawHub
User pulls manually
Exfiltration Risk
BetterClaw
Reviewed for every skill
ClawHub
Confirmed by Cisco
Build Skills for the BetterClaw Marketplace
If you're a skill developer, you can submit your skills for BetterClaw's security review. Skills that pass our 4-layer audit are published in the marketplace and available to every BetterClaw user.
What we review for
- Malicious code patterns (data exfiltration, reverse shells)
- Prompt injection vectors
- Excessive permissions
- Data handling practices
What you get
- "BetterClaw Audited" badge on your skill
- Distribution to all BetterClaw users
- One-click installation for your users
- Pre-configured permission scoping
Skills Marketplace: Common Questions
Why does BetterClaw only have 200+ skills when ClawHub has 13,700+?
Every skill in BetterClaw's marketplace has been manually reviewed through a 4-layer security audit covering malicious code, data exfiltration, prompt injection, and permission scoping. We prioritized the most popular and useful skills first. The library grows every week. We chose safety over size because one malicious skill can compromise your agent's access to email, calendar, files, and API keys.
Are BetterClaw skills different from ClawHub skills?
BetterClaw skills use the same OpenClaw skill format. The difference is the security layer on top. Every BetterClaw skill has been reviewed for malicious code, data exfiltration, prompt injection, and excessive permissions. When you install a skill on BetterClaw, it comes with pre-configured permissions and integrates with your agent's trust level.
Can I use ClawHub skills on BetterClaw?
BetterClaw's marketplace includes only skills that have passed our security review. If there's a ClawHub skill you want that isn't in our marketplace yet, you can request it. We'll review it and add it if it passes our 4-layer audit.
How do I install a skill on BetterClaw?
One click. Browse the marketplace, find the skill you want, and click "Add to Agent." The skill is installed with pre-configured permissions and inherits your agent's trust level. No CLI commands, no config files, no manual setup.
How does BetterClaw's skill vetting work?
Every skill goes through a 4-layer manual review: code review for malicious patterns, exfiltration vector analysis, prompt injection testing, and permission scope verification. The full process is documented on our security vetting page.
Can I submit my own skill to BetterClaw?
Yes. Skill developers can submit skills for security review. Skills that pass the 4-layer audit are published in the marketplace with a "BetterClaw Audited" badge and distributed to all BetterClaw users with one-click installation.
Do skill updates go through review again?
Yes. When a skill is updated, the new version goes through the same 4-layer review before the update is pushed to BetterClaw users. This prevents the "bait and switch" attack pattern where a legitimate skill passes initial review and then adds malicious code in a later update.
Deploy an Agent With Audited Skills in 2 Minutes
Deploy your first agent in under 2 minutes. No Docker. No config files. No SSH. Just tell your agent what to do and watch it work.
$29/month per agent · BYOK · 7-day money-back guarantee