How to Install Skills from ClawHub: Complete Guide

Installing ClawHub skills for OpenClaw is the fastest way to add new capabilities to your agent. ClawHub is the official skills marketplace for OpenClaw, hosting thousands of skills from official publishers and community contributors. This guide covers finding, evaluating, and safely installing skills.

What Is ClawHub?

ClawHub (clawhub.io) is OpenClaw's official marketplace for skills and plugins. It hosts:

• Official skills published by the OpenClaw team (verified, high quality)
• Community skills published by independent developers (variable quality — review carefully)
• Premium skills sold by developers (ClawHub takes a percentage)
• Enterprise skills for business workflows

Following the ClawHavoc malware campaign in 2025/2026, ClawHub introduced mandatory automated security scanning and a publisher verification system for all new skill submissions.

Browsing ClawHub

The ClawHub website (clawhub.io) and the in-agent browser (via the clawhub CLI) both let you search by:

• Category (productivity, development, communication, etc.)
• Publisher verification status
• Install count and ratings
• Recently updated skills

Security Review Before Installing

Before installing any community skill, review:

1. Publisher verification: Look for the blue checkmark — verified publishers have undergone identity verification
2. SKILL.md permissions: Check what access the skill requests. Be suspicious of skills requesting execute_command unless it's clearly needed
3. GitHub repository: Community skills should link to a public repository — check commit history, open issues, and the code itself
4. Install count: Skills with 10,000+ installs have more community review
5. Recent updates: Skills abandoned for 12+ months may have unpatched vulnerabilities

Installing via CLI

# Search for a skill
python -m openclaw skill search calendar

# View skill details
python -m openclaw skill info google-calendar

# Install a skill
python -m openclaw skill install google-calendar

# Install a specific version
python -m openclaw skill install google-calendar@2.1.0

Installing via Dashboard

On nacre.sh, navigate to Skills → Browse ClawHub to browse and install skills through the web dashboard. No CLI required.

Managing Installed Skills

# List installed skills
python -m openclaw skill list

# Update all skills
python -m openclaw skill update --all

# Update a specific skill
python -m openclaw skill update google-calendar

# Remove a skill
python -m openclaw skill remove google-calendar

# Disable a skill without removing
python -m openclaw skill disable google-calendar

The Top Skills by Category

• Productivity: google-calendar, notion, obsidian, todoist
• Development: github, gitlab, docker-manager
• Research: web-search, arxiv-search, wikipedia
• Communication: email-manager, mixpost-social
• Data: csv-processor, json-tools, sql-query

Frequently Asked Questions

What happened during the ClawHavoc campaign?

ClawHavoc was a 2025 malware campaign that placed 341 malicious skills on ClawHub. These skills appeared legitimate but contained code that exploited CVE-2026-25253 to execute arbitrary commands. ClawHub subsequently implemented automated security scanning and mandatory code review for all new skills.

Can I install skills from outside ClawHub?

Yes. You can install from any Git URL or local directory using python -m openclaw skill install <path>. Be extra careful with non-ClawHub skills as they bypass ClawHub's scanning.

How do I verify a skill is safe to install?

Read the SKILL.md permissions, review the Python code in main.py, check the GitHub repository for activity and issues, and verify the publisher identity. When in doubt, don't install.