OpenClaw plugins vs skills: code, instructions, and the trust line
Skills are markdown; plugins are code running inside your Gateway, and most channels are plugins. The allowlist mechanics, and what that startup warning means.
Plugins are code that extends OpenClaw: new channels, model providers, tools, even voice calling. Skills are markdown instructions that teach the agent workflows using tools it already has. The practical difference: a skill is a document; a plugin runs inside your Gateway process with everything that implies, which is why OpenClaw’s docs say to treat plugin installs like running code.
Tool, skill, or plugin?
OpenClaw’s capability model has three layers, and the docs draw the lines cleanly. A tool is a typed function the model can call: exec, browser, message. A skill is a SKILL.md instruction pack loaded into the prompt, right when the agent has the tools but needs the recipe. A plugin is for everything with actual machinery: code, credentials, lifecycle hooks, packaging. Plugins can register new tools, add channels, wire in model providers, and even ship skills of their own: the browser plugin, for instance, bundles a browser-automation skill alongside the code.
You’re probably already running several
The fact that reframes the whole topic: of OpenClaw’s roughly two dozen chat channels, only two ship in the core install: Telegram and the built-in WebChat. Everything else (Discord, Slack, Signal, WhatsApp, iMessage, Matrix, Microsoft Teams, and the rest) is an official plugin, installed with one command (openclaw plugins install @openclaw/discord). There’s a voice-calling plugin that places and answers real phone calls through Twilio-class providers. So “should I use plugins?” is usually moot; the real question is which ones you’ve granted, and on whose authority.
The trust dials that matter
Plugins install from several sources: ClawHub (clawhub:), npm, git, or a local path. OpenClaw ships real controls for deciding what actually loads:
plugins.allowis an exclusive allowlist: set it, and anything not listed stays unavailable.plugins.denybeats everything, including per-plugin enables.- The startup warning
plugins.allow is empty(“discovered non-bundled plugins may auto-load”) is OpenClaw telling you the allowlist isn’t set and it found plugin code it may load. The right response: runopenclaw plugins listwith--enabled --verbose, inspect what it found, and pin the ones you trust intoplugins.allow. - Plugins found inside the agent’s own workspace are disabled by default: your agent can’t quietly write itself an extension and have it load. Enabling one is an explicit human act.
- Installs from arbitrary npm/git sources require an explicit force flag in unattended setups, and a
security.installPolicyhook can run your own review command before any install proceeds.
Why the caution is proportionate
A skill you regret is a document you delete. A plugin runs in-process with the Gateway (the docs’ phrase is “treat them as trusted code”), meaning a malicious one could reach whatever the Gateway reaches: config, credentials, session history, the filesystem. ClawHub runs automated checks on published plugins and gates publishing, which raises the floor without making the decision for you. The operating rule we’d put on a sticky note: install channels and capabilities from official sources freely; treat everything else with the same paranoia you’d give a shell script from a stranger, because mechanically that’s what it is.