How ClawHub Manages OpenClaw Skills and Plugins
This page explains how ClawHub acts as a registry for OpenClaw skills and plugins, covering listings, versions, installs, publishing, scans, and updates. It is intended for users and publishers who need to understand the registry's role and features.
Read this when
- Understanding listings, versions, installs, publishing, and moderation
How ClawHub Works
OpenClaw skills and plugins are managed through ClawHub, which acts as their registry layer. It provides a central location where users can find packages, publishers can distribute new versions, and OpenClaw itself can obtain the metadata required for safe installation and updates.
Registry records
A publicly listed item in the registry contains:
- a package name, along with an owner and slug
- at least one published version
- source attribution, files, a summary, and metadata
- tag and changelog details like
latest - signals for stars, installs, and downloads
- moderation status and security scan results
Before installing any skill or plugin, users can inspect its listing page to see what it claims to do.
Skills
A skill is a versioned collection of text files centered on SKILL.md. It may also include scripts, templates, examples, and supporting files.
ClawHub parses the SKILL.md frontmatter to extract the skill's name, description, environment variables, requirements, and other metadata. Keeping this metadata accurate is important because it helps users decide whether to install the skill and allows automated scans to detect mismatches between what is declared and what is actually observed.
Refer to Skill format for more details.
Plugins
Plugins are packaged extensions for OpenClaw. ClawHub stores version records, artifacts, source links, compatibility information, and package metadata.
When OpenClaw installs a plugin from ClawHub, it first checks the advertised compatibility metadata. Package records may include artifact digests, environment requirements, host targets, minimum gateway version, and API compatibility.
To make the registry the authoritative source, use an explicit ClawHub install source:
openclaw plugins install clawhub:<package>
Publishing
When a publisher creates a new version record, it becomes immutable. The clawhub CLI handles authenticated registry workflows for publishers:
clawhub skill publish ./my-skill
clawhub package publish <source> --family code-plugin --dry-run
clawhub package publish <source> --family code-plugin
Before uploading, run a dry run to preview the final payload. After publishing, public pages display the metadata, files, source attribution, and scan status.
Installs and updates
OpenClaw's install commands rely on ClawHub as a package source:
openclaw skills install @openclaw/demo
openclaw plugins install clawhub:<package>
OpenClaw records the install source metadata so that later updates can resolve the same registry package. For users who want registry-managed skill folders outside a full OpenClaw workspace, the ClawHub CLI also supports direct install and update workflows for skills.
Security state
Although ClawHub allows publishing, releases are still subject to upload gates, automated checks, user reports, and moderator actions.
When available, public pages display scan summaries. Content that is held, hidden, or blocked may disappear from public search and install flows while remaining visible to the owner for diagnostic purposes.
See Security, Security Audits, Moderation and Account Safety, and Acceptable usage.
API access
ClawHub provides public read APIs for discovery, search, package details, and downloads. Third-party catalogs may use these APIs provided they link back to the canonical ClawHub listing, respect rate limits, and do not imply endorsement.
See Public API and HTTP API.