Skip to main content
The Skills API enables agents to extend their capabilities through Python, Node.js, WASM, or prompt-only modules. Skills are installed from FangHub (OpenFang marketplace) or ClawHub (OpenClaw ecosystem compatibility).

​
List Installed Skills

Retrieve all skills installed on the system. 
curl http://127.0.0.1:4200/api/skills
​
skills
array
{
  "skills": [
    {
      "name": "github",
      "version": "1.0.0",
      "runtime": "prompt_only",
      "description": "GitHub integration for issues, PRs, and repos",
      "bundled": true,
      "author": "OpenFang Team",
      "tools": ["github_list_issues", "github_create_pr"]
    },
    {
      "name": "docker",
      "version": "1.0.0",
      "runtime": "prompt_only",
      "description": "Docker container management",
      "bundled": true,
      "author": "OpenFang Team",
      "tools": ["docker_ps", "docker_logs"]
    }
  ],
  "total": 60
}

​
Install Skill

Install a skill from a local path or URL. 
curl -X POST http://127.0.0.1:4200/api/skills/install \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/path/to/skill",
    "verify": true
  }'
​
source
string
required
Skill source:
  • Local path: /path/to/skill
  • URL: https://example.com/skill.zip
  • Git repository: https://github.com/user/skill.git
​
verify
boolean
default:"true"
Verify SHA256 checksum and scan for prompt injection
{
  "status": "installed",
  "skill": "my-custom-skill",
  "version": "1.0.0"
}

​
Uninstall Skill

Remove an installed skill. Bundled skills cannot be uninstalled. 
curl -X POST http://127.0.0.1:4200/api/skills/uninstall \
  -H "Content-Type: application/json" \
  -d '{"name": "my-custom-skill"}'
​
name
string
required
Skill name
{
  "status": "uninstalled",
  "skill": "my-custom-skill"
}

​
Create Skill

Generate a new skill from a template. 
curl -X POST http://127.0.0.1:4200/api/skills/create \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-skill",
    "runtime": "python",
    "description": "A custom skill"
  }'
​
name
string
required
Skill name (lowercase, hyphen-separated)
​
runtime
string
required
Runtime: prompt_only, python, nodejs, or wasm
​
description
string
Skill description
{
  "status": "created",
  "skill": "my-skill",
  "path": "/home/user/.openfang/skills/my-skill"
}

​
FangHub Marketplace

Search and install skills from FangHub (community marketplace).

​
Search FangHub

curl "http://127.0.0.1:4200/api/marketplace/search?q=weather&page=1"
​
q
string
required
Search query
​
page
integer
default:"1"
Page number
​
results
array
​
total
integer
Total search results
​
page
integer
Current page number
{
  "results": [
    {
      "name": "weather-api",
      "author": "community",
      "description": "Real-time weather data integration",
      "downloads": 1250,
      "version": "2.1.0",
      "rating": 4.5
    }
  ],
  "total": 1,
  "page": 1
}

​
ClawHub Integration

Install skills from ClawHub (OpenClaw ecosystem compatibility). All ClawHub skills are automatically converted from SKILL.md format to OpenFang skill.toml format.

​
Search ClawHub

curl "http://127.0.0.1:4200/api/clawhub/search?q=data-pipeline"
​
q
string
required
Search query
{
  "results": [
    {
      "slug": "data-pipeline",
      "name": "Data Pipeline",
      "description": "ETL data pipeline automation",
      "author": "clawhub-community",
      "version": "1.2.0"
    }
  ],
  "total": 1
}

​
Browse ClawHub

Browse skills by category. 
curl "http://127.0.0.1:4200/api/clawhub/browse?category=data&page=1"
​
category
string
Category filter: data, web, ai, devops, finance, etc.
​
page
integer
default:"1"
Page number
{
  "skills": [
    {
      "slug": "data-pipeline",
      "name": "Data Pipeline",
      "category": "data",
      "description": "ETL data pipeline automation"
    }
  ],
  "total": 15,
  "page": 1
}

​
Get ClawHub Skill Details

curl http://127.0.0.1:4200/api/clawhub/skill/{slug}
​
slug
string
required
Skill slug
​
slug
string
Skill slug
​
name
string
Skill name
​
description
string
Full description
​
author
string
Skill author
​
version
string
Latest version
​
runtime
string
Runtime type
​
readme
string
Full README.md content
​
sha256
string
SHA256 checksum

​
Install ClawHub Skill

Install a skill from ClawHub. Automatically converts from OpenClaw format. 
curl -X POST http://127.0.0.1:4200/api/clawhub/install \
  -H "Content-Type: application/json" \
  -d '{"slug": "data-pipeline"}'
​
slug
string
required
ClawHub skill slug
{
  "status": "installed",
  "skill": "data-pipeline",
  "version": "1.2.0",
  "converted_from": "SKILL.md"
}

​
Skill Manifest

Skills are defined by a skill.toml manifest:
skill.toml
name = "my-skill"
version = "1.0.0"
author = "Your Name"
description = "A custom skill"
runtime = "python"  # or nodejs, wasm, prompt_only

# Tool definitions
[[tools]]
name = "my_tool"
description = "Does something useful"
parameters = [
  { name = "input", type = "string", required = true },
  { name = "options", type = "object", required = false }
]

# Runtime configuration (for python/nodejs/wasm)
[runtime_config]
entry_point = "main.py"
dependencies = ["requests", "beautifulsoup4"]

​
Security

All skill installations go through a multi-layer security pipeline:
  1. SHA256 verification — Checksum validation
  2. Prompt injection scanning — Detects malicious prompts
  3. Sandbox execution — Skills run in isolated processes
  4. Capability grants — Skills must declare required permissions
  5. Audit logging — All installations logged to Merkle audit trail

​
Skill Capabilities

Skills must declare capabilities in their manifest: 
[capabilities]
network = ["*.example.com"]  # Network access
filesystem = ["read"]         # File access
memory = ["read"]             # Memory access
subprocess = false            # Subprocess spawning

​
Agent Skill Configuration

Agents can configure which skills they use:
agent.toml
# Allowlist mode (explicit list)
skills = ["github", "docker", "my-custom-skill"]

# Default mode (all skills)
skills = []  # Empty = all available skills
API endpoint to update agent skills: 
curl -X PUT http://127.0.0.1:4200/api/agents/{id}/skills \
  -H "Content-Type: application/json" \
  -d '{
    "skills": ["github", "docker"],
    "mode": "allowlist"
  }'

​
Best Practices

Always inspect the skill’s code or manifest before installing:
# Clone the skill repository
git clone https://github.com/user/skill.git
cd skill
cat skill.toml
cat README.md
Check for suspicious network access, filesystem operations, or subprocess calls.
Pin skill versions in agent manifests:
skills = ["[email protected]", "[email protected]"]
This prevents unexpected behavior from auto-updates.
Before deploying to production agents, test skills in a dedicated test agent:
# Spawn test agent
openfang spawn --name test-agent --skills my-new-skill

# Test the skill
openfang chat test-agent "Use my_new_tool to..."
Check logs for skill errors or suspicious behavior:
openfang logs --follow | grep "skill_runner"
Regularly update skills to get bug fixes and security patches:
# Check for updates
curl http://127.0.0.1:4200/api/skills | jq '.skills[] | select(.bundled == false)'

# Reinstall with latest version
curl -X POST http://127.0.0.1:4200/api/skills/install \
  -d '{"source": "https://github.com/user/skill.git"}'

​
Next Steps

Agents API

Configure agent skills

Create Skills

Build custom skills

FangHub

Browse community skills

Security

Skill security model

Build docs developers (and LLMs) love

Get started for freeTalk to us