OpenClaw plugins vs skills: code, instructions, and the trust line
Skills are markdown; plugins are code running inside your Gateway — and most channels are plugins. The allowlist mechanics, and what that startup warning means.
Plugins are code that extends OpenClaw — new channels, model providers, tools, even voice calling. Skills are markdown instructions that teach the agent workflows using tools it already has. The practical difference: a skill is a document; a plugin runs inside your Gateway process with everything that implies — which is why OpenClaw’s docs say to treat plugin installs like running code.
Tool, skill, or plugin?
OpenClaw’s capability model has three layers, and the docs draw the lines cleanly. A tool is a typed function the model can call — exec, browser, message. A skill is a SKILL.md instruction pack loaded into the prompt — right when the agent has the tools but needs the recipe. A plugin is for everything with actual machinery: code, credentials, lifecycle hooks, packaging. Plugins can register new tools, add channels, wire in model providers, and even ship skills of their own — the browser plugin, for instance, bundles a browser-automation skill alongside the code.
You’re probably already running several
The fact that reframes the whole topic: of OpenClaw’s roughly two dozen chat channels, only two ship in the core install — Telegram and the built-in WebChat. Everything else — Discord, Slack, Signal, WhatsApp, iMessage, Matrix, Microsoft Teams, and the rest — is an official plugin, installed with one command (openclaw plugins install @openclaw/discord). There’s a voice-calling plugin that places and answers real phone calls through Twilio-class providers. So “should I use plugins?” is usually moot; the real question is which ones you’ve granted, and on whose authority.
The trust dials that matter
Plugins install from several sources — ClawHub (clawhub:), npm, git, or a local path — and OpenClaw ships real controls for deciding what actually loads:
plugins.allowis an exclusive allowlist: set it, and anything not listed stays unavailable.plugins.denybeats everything, including per-plugin enables.- The startup warning
plugins.allow is empty(“discovered non-bundled plugins may auto-load”) is OpenClaw telling you the allowlist isn’t set and it found plugin code it may load. The right response: runopenclaw plugins listwith--enabled --verbose, inspect what it found, and pin the ones you trust intoplugins.allow. - Plugins found inside the agent’s own workspace are disabled by default — your agent can’t quietly write itself an extension and have it load. Enabling one is an explicit human act.
- Installs from arbitrary npm/git sources require an explicit force flag in unattended setups, and a
security.installPolicyhook can run your own review command before any install proceeds.
Why the caution is proportionate
A skill you regret is a document you delete. A plugin runs in-process with the Gateway — the docs’ phrase is “treat them as trusted code” — meaning a malicious one could reach whatever the Gateway reaches: config, credentials, session history, the filesystem. ClawHub runs automated checks on published plugins and gates publishing, which raises the floor without making the decision for you. The operating rule we’d put on a sticky note: install channels and capabilities from official sources freely; treat everything else with the same paranoia you’d give a shell script from a stranger — because mechanically, that’s what it is.