OpenClaw Engineering, Chapter 7: The Skill Ecosystem

By the end of Chapter 6, you had a single skill working: well-authored, versioned, with dependencies declared and procedures clear. But one skill is barely useful. In practice, agents need access to dozens or hundreds of skills. This chapter covers the ecosystem: how bundled and workspace skills coexist, how skill discovery works, how ClawHub (OpenClaw's community registry) keeps 13,000+ skills from colliding, and how to navigate this landscape without drowning.

Bundled skills and workspace skills

OpenClaw ships with bundled skills: foundational capabilities like file operations, shell commands, HTTP requests, JSON parsing. These are the batteries included in every installation. You'll use them constantly. Examples: file-reader, file-writer, json-parser, http-get, shell-execute. They're vetted, performant, and always available.

Alongside them, you create workspace skills in your local environment, typically in ~/clawd/skills/skill-name/. These follow the exact same SKILL.md format as bundled skills but are version-controlled, tailored to your specific needs. Maybe you have a skill for your company's internal API, or a niche business process no one else needs. That's a workspace skill—as easy to create as bundled skills, just a directory with a SKILL.md file. No compilation, no deployment pipeline.

The critical design pattern is overrides. If a workspace skill has the same name as a bundled skill, the workspace skill wins. The bundled execute-sql works with PostgreSQL? You create a workspace version for Oracle, and when your agent runs, it uses yours. This allows customization without forking the entire codebase. When bundled skills update upstream, you choose to adopt, stay custom, or migrate gradually—vital flexibility in large organizations with heterogeneous tooling.

Skill discovery and context management

At Gateway boot, the system scans for bundled and workspace skills, evaluates their dependencies, and builds a registry. When an agent session starts, the gateway includes a summary of available skills in Claude's context—not the full SKILL.md text (that would be huge with hundreds of skills), just metadata: name, description, key fields. Claude can then understand what's available and decide which skills to invoke.

When Claude chooses to use a specific skill, the full SKILL.md text is retrieved on-demand, pulled into context, and the agent follows the instructions. This lazy-loading pattern keeps context manageable even with 50+ workspace skills and 100+ installed from ClawHub. You don't load everything upfront; you load what you need when you need it.

The discovery process also includes filtering. Some skills might be marked 'internal only' or 'admin only'—they won't appear in the summary given to regular agents. This allows specialized skills for specific contexts. An emergency-shutdown skill might only be available to operators, not regular agents. The YAML frontmatter can include a visibility field to control this, or your configuration can restrict access by role.

Skill metadata can hint at dependencies and relationships. If generate-sql and execute-sql are often used together, or if data-fetch should precede data-analyze, some skill authors include a 'Complementary Skills' field in the SKILL.md metadata. This helps Claude chain skills intelligently without needing explicit orchestration.

ClawHub: the community registry

ClawHub is OpenClaw's package registry, like npm for JavaScript or PyPI for Python. As of February 2026, ClawHub hosts 13,729 skills—a thriving ecosystem. If you've built a skill that might help others, you can publish it. If you need a skill, you can find and install it. The barrier to entry is low: create SKILL.md, verify it works, run one command to publish.

Publishing starts with authentication. You need a ClawHub account (free) and an API token. Run clawhub login, paste your token, and it's stored securely. Then navigate to your skill directory and run clawhub publish. The CLI validates the SKILL.md, scans for hardcoded secrets (API keys, passwords), checks that dependencies are documented, and uploads it. The first time you publish a skill with a given name, you're creating it; subsequent publishes increment the version. Your account becomes the owner; only you (or collaborators you grant access to) can publish new versions.

ClawHub's validation is thorough: it checks for well-formed YAML, scans for secret patterns (like 'sk_live_' for Stripe keys, 'AKIA' for AWS), and verifies dependencies are declared. It doesn't deeply analyze behavior, but it catches common mistakes and prevents obvious security blunders. Once published, your skill is discoverable and installable via the CLI.

Installing is just as easy: clawhub install skill-name downloads it and places it in your workspace skills directory. The gateway picks it up on next boot. You can even pin versions: clawhub install skill-name@1.0.0 ensures you get exactly that version—critical for production systems where you want stable, predictable versions.

Search and discovery at scale

With 13,000 skills, finding the right one can be overwhelming. ClawHub uses embedding-based vector search. Rather than simple keyword matching, skill descriptions are embedded into semantic vectors—high-dimensional representations of meaning. When you search for 'email delivery,' ClawHub finds not just skills with those exact words, but related skills: messaging, SMTP, notifications. You can search for fuzzy concepts like 'send alerts to my team' and ClawHub understands you probably want notification-related skills, even if you didn't use the exact terms.

ClawHub tracks engagement metrics: stars, downloads, comments. The most popular skills become visible on the homepage. As of early 2026, the top downloaded skills are: capability-evolver (a meta-skill that lets agents learn from execution history and create new internal skills to handle recurring tasks), gog (Google Workspace integration for Docs, Sheets, Gmail), agent-browser (web automation and scraping), and agent-team-orchestration (coordinating multiple agents). These represent the most in-demand automation scenarios. capability-evolver is particularly interesting—it exemplifies the recursive nature of the skill ecosystem: agents can use skills to write new skills.

Managing workspace skills at scale

As your skill collection grows, treat the ~/clawd/skills/ directory like source code. Version it in Git. For each skill, use semantic versioning in the YAML (major.minor.patch). Git history becomes a record of skill evolution: when did you add support for a new API? When did you deprecate v1.0? Use Git tags to mark release points: 'released skill-x v2.0.0 on 2026-02-15.' This discipline pays off when auditing changes or rolling back.

A practical workflow: Create a repository (e.g., 'my-org-skills') with all workspace skills. Developers submit pull requests to add or modify skills. Each PR triggers automated checks: SKILL.md validation, secret scanning, syntax checks, basic functionality tests. After review and merge, the skill is available. If you have a continuous deployment pipeline, new skills could be available within minutes—far faster than publishing to ClawHub and installing from there. This is invaluable for rapidly evolving internal tools.

Common automated checks: (1) Validate YAML syntax. (2) Scan for hardcoded secrets. (3) Ensure all environment variables are documented. (4) Check that Markdown instructions don't reference undefined variables. (5) Run the skill against test inputs and verify expected outputs. These catch errors before reaching production, preventing broken skills from being deployed.

As your collection grows, organize by category or domain. You might have a 'data' directory for data processing, an 'integration' directory for external APIs, and a 'maintenance' directory for operational tasks. This organization makes discovery easier and clarifies your automation landscape. Some teams maintain a 'deprecated' directory for skills no longer used but kept for historical reference.

The meta-skill: agents that evolve themselves

One of the most fascinating skills in the ecosystem is capability-evolver. It allows an agent to reflect on past executions, identify patterns in what it's done, and create new internal skills to handle recurring tasks. An agent might notice, 'I've handled customer billing inquiries 50 times. I should write a skill for this.' It generates a SKILL.md, stores it as a workspace skill, and on its next run uses the new skill. The agent teaches itself.

This meta-skill exemplifies the recursive nature of the ecosystem: agents can use skills to improve themselves, creating a feedback loop of increasing sophistication. It's not full self-modification (the agent can't change its core system prompt), but it's close enough to feel alive. Some teams have reported agents that have written 10+ custom skills within a month of deployment, all tailored to their specific organizational patterns.

What's next

With skills organized, discovered, and deployed, the question becomes: how do you trigger them? So far, we've discussed pull-based scenarios—the agent decides to use a skill when a user sends a message. But agents can also be event-driven. Chapter 8 covers Event-Driven Workflows: how to wire agents to respond to webhooks, scheduled events, and external system triggers. That's where autonomy truly emerges—agents that wake themselves up when there's work to do, without waiting for a user request.