OpenClaw Marketplace and Skills Catalog 2026: Browse and Publish

The OpenClaw Marketplace is where the community publishes pre-built Skills you can drop into your agents. By 2026 the catalog covers CRM, ERP, data warehouses, observability, payment processors, communication tools, and a long tail of niche integrations. Most agents we ship for ECOSIRE clients use 60-80% Marketplace Skills and 20-40% custom Skills written in-house.

This article is the practical tour: what is in the catalog, how to browse and install Skills, and — for teams ready to share back — how to publish your own Skills with the audit and versioning the platform requires. By the end you will know whether to wire a Skill yourself or pull one from the catalog, and how to contribute.

Key Takeaways

• The Marketplace is a versioned, audited catalog of Skills you can install with openclaw install <skill> from the CLI.
• Skills are organized by category (CRM, ERP, Data, Observability, Payments, Comms) and tagged for search.
• Each Skill has a manifest declaring inputs, outputs, side effects, required permissions, and supported runtime versions.
• Skills carry a quality tier: Verified (ECOSIRE/IBM/AWS-published), Community (third-party), Experimental (alpha).
• Installing a Skill is openclaw install crm/[email protected] — semver-pinned, reproducible.
• Publishing your own Skill requires a manifest, tests, and passing the security scan; takes ~1-2 hours for a clean Skill.
• Private Marketplaces are supported for organizations that want internal-only Skill sharing.
• Skills are NOT plugins — they run in your runtime, not the marketplace's. Sandboxing is your responsibility.

---

What Is a Skill, Exactly?

A Skill is a typed Python function (or a small bundle of related functions) registered with the @skill decorator. It has:

• A unique name (crm.salesforce.lookup_account).
• A semver version (2.1.0).
• Typed inputs and outputs (Pydantic models or simple types).
• A description used by the LLM tool-calling layer.
• An optional manifest declaring permissions, dependencies, and lifecycle hooks.
• Tests demonstrating correct behavior.

Example minimal Skill:

from openclaw import skill
from pydantic import BaseModel

class AccountResult(BaseModel):
    id: str
    name: str
    industry: str | None
    annual_revenue: float | None

@skill(
    name="crm.salesforce.lookup_account",
    description="Look up a Salesforce account by name. Returns account record.",
    version="2.1.0",
    permissions=["tool:salesforce"],
    requires_runtime=">=1.4.0",
)
def lookup_account(name: str) -> AccountResult | None:
    sf = get_salesforce_client()
    result = sf.query(f"SELECT Id, Name, Industry, AnnualRevenue FROM Account WHERE Name = '{name}'")
    if not result["records"]:
        return None
    rec = result["records"][0]
    return AccountResult(
        id=rec["Id"],
        name=rec["Name"],
        industry=rec.get("Industry"),
        annual_revenue=rec.get("AnnualRevenue"),
    )

That is all that is required to publish.

Catalog Categories Overview

As of 2026, the OpenClaw Marketplace organizes Skills into these top-level categories:

Each category has 5-15 Skills. Most cover the obvious operations (lookup, create, update, search). Some bundle related operations into a Skill Pack (e.g., crm.salesforce-pack includes 12 related skills for Salesforce).

Browsing the Catalog

Web

Visit marketplace.openclaw.dev. Search by keyword, filter by category, sort by popularity or recency. Each listing shows:

• Description, version, supported runtime versions.
• Author and organization.
• Quality tier (Verified / Community / Experimental).
• Install count, last updated.
• Source code link, test coverage, security scan status.
• Permissions required and side effects.

CLI

openclaw search "salesforce"

crm.salesforce.lookup_account     2.1.0    Verified     ECOSIRE
crm.salesforce.create_lead        2.1.0    Verified     ECOSIRE
crm.salesforce.update_opportunity 1.4.0    Verified     ECOSIRE
crm.salesforce.run_soql           1.2.0    Community    @user
crm.salesforce-pack               2.0.0    Verified     ECOSIRE  (bundle)

openclaw info crm.salesforce.lookup_account

Detailed view including manifest, permissions, and example usage.

Installing a Skill

openclaw install [email protected]

This:

1. Downloads the Skill bundle to skills/_marketplace/.
2. Verifies the signature against the marketplace registry.
3. Runs the Skill's security scan locally.
4. Registers the Skill with the runtime.
5. Pins the version in openclaw.lock for reproducible installs.

Restart your runtime to load the new skill:

docker compose restart openclaw-runtime

Then add it to an agent manifest:

skills:
  - crm.salesforce.lookup_account

The Skill works exactly like a Skill you wrote yourself.

Quality Tiers

The Marketplace uses three tiers to set expectations:

Verified: published by ECOSIRE or trusted organization partners (IBM, AWS, Snowflake, Salesforce, etc.). Code reviewed by the OpenClaw team, full test coverage, security scanned, indemnified for organizations on the Cloud Plus tier. Use these in production without hesitation.

Community: published by community contributors. Manifest, tests, and security scan passing, but not peer-reviewed by ECOSIRE. Quality varies. Read the source before using in production.

Experimental: alpha-stage Skills. Use for prototyping; expect breaking changes. Not recommended for production.

The CLI shows the tier on every install:

openclaw install user/[email protected]
# WARNING: this Skill is Experimental. Not recommended for production.

Authentication and Secrets

Skills that call external services need credentials. OpenClaw's secrets pattern:

1. Skills declare required environment variables in the manifest.
2. Your .env (dev) or secret manager (prod) supplies them.
3. The runtime injects them; the Skill reads via os.environ.

Salesforce Skill manifest excerpt:

secrets_required:
  - SF_USER
  - SF_PASS
  - SF_TOKEN
secrets_optional:
  - SF_INSTANCE_URL

Failing to provide required secrets blocks the Skill from registering — fail fast, before agents try to use it.

For production we recommend secret managers (AWS Secrets Manager, Hashicorp Vault, Azure Key Vault). OpenClaw has built-in connectors that pull secrets at runtime instead of relying on env vars.

Publishing Your Own Skill

If you have wired an integration that others might use, publishing it is a 1-2 hour project. Skills can be published privately (your org only) or publicly to the Marketplace.

Step 1: Scaffold

openclaw skill init my-awesome-skill

This creates:

my-awesome-skill/
├── pyproject.toml
├── README.md
├── skill.yaml          # Skill manifest
├── src/
│   └── my_awesome_skill.py
└── tests/
    └── test_skill.py

Step 2: Write the Skill

from openclaw import skill
from pydantic import BaseModel

class Result(BaseModel):
    foo: str
    bar: int

@skill(
    name="user.my-org.awesome-skill",
    description="Does something awesome with input and returns Result.",
    version="0.1.0",
    permissions=["tool:my_api"],
    requires_runtime=">=1.4.0",
)
def awesome_skill(input_text: str) -> Result:
    # ... implementation
    return Result(foo="hello", bar=42)

Naming convention: <scope>.<org>.<name>. Scope is one of user, org, crm, erp, etc.

Step 3: Write Tests

from openclaw.testing import skill_test

def test_awesome_skill_returns_expected():
    from my_awesome_skill import awesome_skill
    result = awesome_skill("input")
    assert result.foo == "hello"
    assert result.bar == 42

def test_awesome_skill_handles_empty_input():
    from my_awesome_skill import awesome_skill
    result = awesome_skill("")
    assert result.foo == "empty"

Test coverage minimum for Verified tier: 80%. Community tier: 60%. Experimental: any tests.

Step 4: Manifest

skill.yaml:

name: user.my-org.awesome-skill
version: 0.1.0
description: Does something awesome.
author: My Org
license: Apache-2.0
homepage: https://github.com/my-org/awesome-skill
permissions:
  - tool:my_api
secrets_required:
  - MY_API_KEY
runtime:
  min_version: 1.4.0
  max_version: 2.x
side_effects:
  - reads_external_api
  - writes_no_data
quality_tier: community
tags:
  - integration
  - my-domain

Step 5: Publish

openclaw skill publish --target marketplace
# or for private (your org only):
openclaw skill publish --target private

The publish command:

1. Runs your tests.
2. Runs a security scan (Bandit, Semgrep).
3. Uploads the bundle to the marketplace registry.
4. Signs the bundle with your publisher key.
5. Lists in the catalog after a brief automated review.

Verified tier requires a separate review process — file a request with the OpenClaw team for that promotion.

Private Marketplaces

Many organizations want a private Skill catalog: internal connectors, proprietary logic, sensitive data flows. OpenClaw supports private Marketplaces self-hosted alongside your runtime.

openclaw marketplace start --name my-org-private
openclaw config set marketplace.my-org-private.url https://marketplace.internal.example.com

Skills published to a private marketplace are only installable by users authenticated to your registry. No data leaves your infrastructure.

This is the standard pattern for ECOSIRE clients in regulated industries. Verified Skills come from the public Marketplace; proprietary Skills live in the private registry.

Skill Versioning and Updates

Skills follow semver:

• PATCH (1.4.0 → 1.4.1): bug fixes, no API changes. Safe to auto-upgrade.
• MINOR (1.4.0 → 1.5.0): new features, backward compatible. Test before upgrading.
• MAJOR (1.4.0 → 2.0.0): breaking changes. Plan migration.

The lockfile (openclaw.lock) pins exact versions. Upgrade explicitly:

openclaw upgrade crm.salesforce.lookup_account
# or upgrade all
openclaw upgrade --all --pre-release=false

CI/CD should pin versions and only upgrade in deliberate PRs.

Security and Sandboxing

Important: Marketplace Skills run in YOUR runtime with YOUR credentials. The Marketplace verifies signatures and runs scans, but it does not provide isolation. Treat Skills like any third-party code:

• Pin to specific versions.
• Audit Verified tier Skills for production.
• Review Community Skills before installing.
• Avoid Experimental Skills in production.
• Use the principle of least privilege for permissions.
• Consider running risky Skills in a separate runtime instance with restricted credentials.

OpenClaw provides syscall-level sandboxing for Skills marked sandbox: true in the manifest, but it adds latency. Use selectively for untrusted code.

Marketplace by the Numbers (2026)

Growth is steady; we expect 200+ Verified Skills by end of 2026 as more partners publish.

Common Skills We Recommend

For a typical SaaS or enterprise integration agent, install these from day one:

openclaw install comms.slack.send-message
openclaw install comms.email.send-via-ses
openclaw install data.snowflake.run-query
openclaw install search.web.brave
openclaw install utils.summarize
openclaw install utils.classify-text
openclaw install compliance.pii-redact
openclaw install crm.salesforce-pack
openclaw install observability.datadog.send-event

These cover ~70% of agent operations across our client base.

Frequently Asked Questions

Can I use Marketplace Skills offline?

Yes. Skills are installed locally; once installed, they don't need Marketplace connectivity. The Marketplace is used for browse, install, and update only. For air-gapped environments, mirror the Marketplace registry to your private registry.

What happens if a Skill is removed from the Marketplace?

Already-installed Skills continue to work. New installs of that exact version may fail if the bundle was hard-deleted. We retain bundles for at least 12 months after delisting per our policy.

How do I prevent malicious Skills?

Pin versions in openclaw.lock and audit all Community/Experimental Skills before use. Verified Skills go through code review and security scans. For maximum safety, run Skills with sandbox: true and least-privilege credentials.

Can Skills depend on other Skills?

Yes. The manifest can list depends_on: [[email protected]]. The runtime resolves dependencies at install time.

Where can I get help building a custom Skill or migrating from another framework?

ECOSIRE builds custom Skills for clients regularly — proprietary integrations, domain-specific logic, complex multi-step Skills. Talk to our OpenClaw custom skills team or browse OpenClaw products for pre-built Skill bundles you can license. For new agent builds, see our installation quickstart.

---

The Marketplace is the leverage that makes OpenClaw teams ship fast. Install what already works, write Skills only for what is unique to your business, and publish back what others might use. By the time you have shipped 3-4 agents, you will have a solid mental model of when to install vs build, and your Skill catalog will grow alongside your agent fleet.