The 10 best OpenClaw skills to install first

By Linas Valiukas · March 11, 2026

OpenClaw's skill registry — ClawHub — has over 13,000 community-built skills. That's the good news. The bad news is that nobody tells you which ones to install first, which ones are safe, and which ones are a waste of your system prompt tokens. I've tested dozens. Here are the 10 I'd install on a fresh setup, in the order I'd install them.

1. SecureClaw — lock your instance down before anything else

GitHub · Free · By Adversa AI

Over 40,000 OpenClaw instances are running exposed on the public internet right now. A zero-click WebSocket vulnerability (CVE-2026-25253) lets any website silently hijack your agent. Two governments issued formal advisories about it.

SecureClaw runs 56 automated security checks across 8 categories, then applies fixes: binding the gateway to localhost, locking file permissions, creating tamper-detection baselines. It also loads 15 behavioral rules into your agent's context that govern how it handles credentials, external content, and destructive commands. All detection runs as external bash processes — zero extra LLM tokens for the scanning part.

Install this first. Not second. First.

2. GOG — Google Workspace in one skill

ClawHub · Free · Requires Google OAuth setup

GOG connects Gmail, Google Calendar, Drive, Contacts, Sheets, and Docs through a single integration. It's the single most impactful skill you can install. Before GOG, your agent can chat. After GOG, it can actually check your calendar, draft email replies, pull data from your spreadsheets, and find files in your Drive.

The average knowledge worker spends 28% of their workday on email. That stat is depressing, but it's also the reason GOG makes such an immediate difference. "What's on my calendar tomorrow?" goes from a question your agent can't answer to one it handles in seconds.

The OAuth setup takes about 10 minutes. Annoying, but you only do it once.

3. Playwright — give your agent a browser

Docs · Free · Built on Playwright MCP

This is what turns OpenClaw from a chatbot into an agent. Playwright gives it a real browser — it can navigate to websites, click buttons, fill out forms, extract content, take screenshots, and handle login flows. Want it to check a price on a website? Book a restaurant? Fill out a government form? This is the skill that makes that possible.

It runs an isolated Chrome profile separate from your personal browser, so your agent's browsing won't mess with your sessions or saved passwords. You can run it headless (no visible window) or headful if you want to watch what it's doing.

4. Tavily — real-time web search

ClawHub · Free tier available · Requires Tavily API key

Without a search skill, your agent only knows what the LLM was trained on — which has a knowledge cutoff and gaps. With Tavily, it can look things up in real time. Ask it "what's the weather in Tokyo" or "what did the Fed announce today" and it actually goes and finds out.

Tavily is built specifically for AI agents. Unlike regular search APIs that dump raw links, it analyzes multiple sources and returns structured, relevant content that OpenClaw can use immediately. It has a basic (fast) and advanced (thorough) mode. The free tier covers most personal use.

5. Summarize — digest anything in seconds

Bundled skill · Free · Ships with OpenClaw

This one ships with OpenClaw — no installation needed. Feed it a URL, a PDF, a YouTube video, or a wall of text, and it returns a structured summary. It sounds simple because it is. That's also why it's the best first skill to try: the value is immediate and obvious.

I use it for long email threads, meeting transcripts, and articles I don't have time to read. If the content is huge, it'll return a tight summary first and ask which section you want expanded. It works with most LLM backends.

6. AgentMail — your agent's own email address

Docs · ClawHub · Free tier · Requires AgentMail account

GOG connects your existing Gmail. AgentMail gives your agent its own dedicated email address (@agentmail.to). Send, receive, reply, forward — all without touching your personal inbox.

Why would you want this? Because some automations need to send email on their own — lead follow-ups, status reports, subscription confirmations — and having those come from your personal address gets messy fast. AgentMail also avoids the OAuth headaches and account-ban risks that come with programmatic access to Gmail.

7. Notion or Obsidian — connect your second brain

Notion skill · Obsidian (bundled) · Free

Pick whichever you use. The Notion skill (better-notion on ClawHub) gives full read/write access to your pages, databases, and blocks. The Obsidian skill is bundled and works with local Markdown vaults.

This is what makes the "second brain" concept actually work. Your agent can search your notes, add to them, create new pages from conversations, and pull context from your existing knowledge base when answering questions. "Save this to my project notes" or "what did I write about X last month?" become real commands instead of wishful thinking.

8. ClawVox (ElevenLabs) — voice calls and text-to-speech

ClawHub · Requires ElevenLabs API key

ClawVox integrates ElevenLabs for text-to-speech, voice cloning, and — the interesting part — actual phone calls. Your agent can join Google Meet calls and speak with a natural voice, or call you directly if a text message fails to deliver.

I mostly use it for morning briefings read aloud while I'm getting ready. "Read me today's calendar and top three emails" is genuinely useful when your hands are busy. ElevenLabs isn't free, but the quality gap between it and built-in TTS is massive.

9. Spotify Player — because not everything has to be productive

Bundled skill · Free · Requires Spotify Premium

Control Spotify from any chat. Queue songs, skip tracks, switch playlists, adjust volume across devices. "Play something chill in the kitchen" works if you've got Spotify Connect set up with multiple speakers.

This isn't a productivity skill. It's just nice. It takes 30 seconds to set up (import your Chrome cookies with spogo auth import --browser chrome) and it makes your OpenClaw setup feel less like a DevOps project and more like an actual assistant.

10. Skill Creator — teach your agent to teach itself

Bundled skill · Free · Ships with OpenClaw

This is the meta-skill. Skill Creator lets OpenClaw write new skills for itself. When your agent hits something it can't do, instead of you searching ClawHub and installing things manually, it can draft a new SKILL.md, test it, and add it to its own toolkit.

It's not magic — the generated skills are simple and sometimes need tweaking. But for quick one-off automations ("check this website every morning and tell me if the price drops below $50"), it saves you from writing anything yourself.

One to avoid: Capability Evolver

Capability Evolver sits at the top of ClawHub's download charts (35,000+ installs) and promises to let your agent "automatically evolve its own capabilities." Sounds great. The problem: security researchers found it exfiltrates data to Feishu — a Chinese cloud service operated by ByteDance. Your agent's memory, conversation history, and skill data gets quietly sent to an external server.

This is exactly why SecureClaw is skill #1 on this list. ClawHub is open, which means anyone can publish anything. The download count doesn't mean it's safe. Always vet community skills before installing them, or use the Skill Vetter tool to scan for known malicious patterns.

The short version

Or skip the setup entirely

Every skill on this list requires installation, configuration, API keys, and ongoing maintenance. SecureClaw needs periodic re-audits. GOG needs OAuth tokens refreshed. Playwright needs a Chrome binary managed. That's the trade-off with self-hosting: maximum flexibility, maximum upkeep.

On TryOpenClaw.ai, we pre-install and configure the essential skills on every instance. Security hardening is applied by default. Google Workspace, browser automation, and web search work out of the box. You don't install skills — you just use them.

Managed hosting starts at $39/month. That covers the server, the skills, and someone else worrying about OAuth tokens at 2am.