DEV Community: Rian O'Leary

Agent Skills: Why They Matter More Than You Think

Rian O'Leary — Tue, 28 Apr 2026 13:41:23 +0000

The biggest change in AI this year isn't a new model. So what is it, and how can you take advantage of it?

Every time a major AI company has announced a product in the last six months, there's been a feature buried in the announcement that nobody in the tech press seems to have noticed. In October, Anthropic published an engineering blog post describing a new architecture for giving AI agents installable, reusable capabilities. The headline coverage was about Claude getting better at specialised tasks. But buried underneath was the actual news: Anthropic had just created a standard that would let any AI agent, on any platform, load permanent new capabilities.

By December 2025, Anthropic had open-sourced it. Within weeks, OpenAI had adopted it for Codex and ChatGPT, GitHub Copilot had added it to VS Code, and Vercel had built an entire distribution layer for it, which is now quietly doing a quarter of a million installs a week.

Anthropic called these shippable capabilities "agent skills". And it's the most important architectural shift in how AI gets used since OpenAI's ChatGPT release in 2022.

This post covers what a skill is, why the change matters more than it sounds, how fast the market around it has formed, and how to install your first one this afternoon.

What a Skill Actually Is

It's easiest to think about a skill as an app for your agent. In the same way you download an app for your phone on a marketplace (the app store), your agent can now install its own app (a skill) through a dedicated skill marketplace/registry (ClawHub).

Mechanically, a skill is a small bundle of files. It usually includes a text file called SKILL.md that tells the agent what the skill does, when to use it, and how it works. Some skills are just detailed instructions while others include code the agent can run, an API the agent can call, or a set of rules for handling specific kinds of input. A skill for reading invoices might include a Python script that parses PDFs. A skill for calendar management might include the logic for connecting to Google Calendar, checking your availability, and proposing meeting slots. A skill for summarising Slack threads might be detailed instructions on how to read a thread and produce a clean summary of your conversations.

Skills live in registries. The biggest public one is ClawHub, which currently hosts over 52,000 of them. When you install a skill from ClawHub, its files get added to a folder your agent reads from. The next time the agent is doing work and encounters a task the skill covers, it uses it.

Why the Architectural Change Matters

Before skills, an AI agent's capabilities were functionally fixed at whatever the model had been trained on, plus whatever you explained to it in the moment. If you wanted it to handle your invoicing, you had to write a careful prompt describing your invoice format, your accounting categories, where things should be filed, and how to handle edge cases. You had to do that every session, because the model forgot everything between conversations. If you wanted a different task, you wrote a different prompt. That was the limit on what anyone could get out of an AI agent without being an expert prompter.

Skills remove this limit. The capability is now a file someone has already written, tested, and published. You install review-invoices and the work has been done by whoever built the skill. Your agent handles invoices the way it handles every other installed capability: automatically, without instruction, in the background.

The smallest reusable unit of AI work used to be a prompt. Now it's a skill. Prompts are written once, by one person, and die at the end of the session. Skills are written once and reused by everyone who installs them. That's a different kind of scaling, and it's the same kind of scaling that made the App Store a different phenomenon from software you wrote for yourself.

The other shift is that skills work across platforms. Anthropic open-sourced the SKILL.md standard in December 2025, which means a skill written for Claude also runs on ChatGPT, GitHub Copilot, Cursor, and most other agent platforms you'd realistically use. That kind of cross-platform compatibility is rare, and it's what turns skills from a Claude feature into the beginning of an actual ecosystem.

How Fast This Is Actually Moving

The other thing worth noting is the pace.

The SKILL.md standard is four months old. In those four months, OpenAI adopted it for Codex and ChatGPT, GitHub Copilot added it to VS Code, and Cursor implemented it. Vercel launched skills.sh, a cross-platform skill installer, in January; one of its utilities, find-skills, is currently doing over 235,000 installs per week. ClawHub has grown to more than 52,000 community-published skills. Agensi, the first paid marketplace for skills, launched at the beginning of the year and already hosts over two hundred paid skills with live payments flowing to creators.

The Apple App Store took six months to reach 15,000 apps. npm, the JavaScript package manager half the internet runs on, took around eight years to cross 350,000 packages. The wider agent skills ecosystem crossed the same threshold in about two months.

This is not a slow-moving market forming gradually. This is a market forming in real time, faster than any comparable technology shift in recent history, and almost nobody outside the ecosystem has noticed yet.

What People Are Doing With Them, and Where the Market Is Going

The simplest use is individual workflow automation. An operator who used to spend an hour every Friday reconciling invoices can now install a skill like an Invoice Extractor, which parses invoices, extracts line items, and logs them to the right accounts. The hour of work becomes a minute. This, multiplied across the dozens of repeatable tasks in a typical freelance or small-business week is a huge compression of the working day.

The more interesting use of skills is how people are packaging that automation and selling it as a service. A one-person operation running a customised skill stack for invoice processing, lead enrichment, research-to-publish, or any of a dozen other repeatable functions can now deliver results that would previously have required a small team. That's a new kind of opportunity, one that didn't exist a year ago. We'll cover specific winning workflows you can use in upcoming Stack Plays.

Then there's where the market itself is going. Most skills today are free. That won't be permanent. Agensi launched a paid marketplace at the beginning of the year and is already processing payments to skill creators. Skills4Agents is in waitlist with an even more creator-friendly revenue split. The commercial infrastructure for paid skills is being built right now, and the window in which skills are free as the default is beginning to close.

Who Writes Skills, and Why Not All of Them Are Safe

Anyone can publish a skill on ClawHub. Most are useful, some are weekend experiments, and a small number are deliberately malicious. That's the trade-off of an open registry. Earlier this year ClawHub had a supply-chain incident nicknamed "ClawHavoc", in which over 1,400 malicious skills were found and removed. The registry has since added security review, but the open model means harmful skills will keep appearing. Spotting them before you install is a skill in itself, and one we'll keep covering.

How to Install Your First Skill

The full walkthrough, covering every supported platform, the exact commands, and what to do when something doesn't work, is in a companion post: How to Install Your First Agent Skill (Start to Finish).

When it works, you'll have installed a capability into an AI agent. Most people who use AI every day haven't done that yet, and this is about to be the default way people use AI for everything.

Agent skills are new. The market is young. The opportunity is clear. This is the only publication mapping the emerging skill economy and teaching you how to capitalise on it. Subscribe to stay early.

This post is part of The Skill Economy, a weekly look at the AI agent skills market. If you want to understand this space before the rest of the world catches up, subscribe for weekly analysis, teardowns, and workflows.

How to Install Your First Agent Skill

Rian O'Leary — Tue, 21 Apr 2026 14:43:24 +0000

A guide to installing your first Agent skill. Take your AI angent to the next level

By the end of this post, your AI agent will have a new capability. Maybe it'll parse PDF invoices into clean line items, summarise a Slack thread, or turn a messy webpage into structured notes. Whichever skill you pick, it'll still be there tomorrow, and next week, and every session after. That's the basic promise of an agent skill: install once, use indefinitely.

A skill is a small installable package that grants an AI agent a new capability. Think of it as an app for your agent. In reality, they consist of a main text file (SKILL.md) and some optional reference files with scripts to run code. When an agent recognises a job that they have a skill for (i.e tracking invoices), they use the SKILL.md file as a reference to complete the job, following the steps to guarantee a high quality, consistent output. Skills stay installed across sessions, trigger automatically when the relevant task comes up, and are shared through public registries like ClawHub, which currently hosts over 52,000 of them.

This post is a walkthrough meant for those who have never heard what an "agent skill" is. All you need is about 20 minutes from a blank start to a working skill that could potentially save you hours of manual work.

Before You Start

You need three things.

First, Node.js installed. Check with this in your terminal:

node --version

A version number means you're fine. A "command not found" means grab it from nodejs.org first.

Second, you need a skill-capable AI platform that works with the clawhub CLI (command line interface. Don't worry about all these techy terms though). The main ones are: OpenClaw, Claude Code, GitHub Copilot (in VS Code, cloud agent, or CLI), Cursor, and Codex CLI. The first three are walked through in detail below; install commands for Cursor and Codex CLI are covered at the end of Step 3. ChatGPT and Claude.ai also support skills, but through their own web-UI upload flows (the Skills page and Settings → Features respectively), not through the CLI-install pattern covered here.

Finally, you need a task you'd like your agent to get faster at. Think big and something that could be genuinely helpful for you and use the steps below to check if a skill is available for it.

One important thing about how the install works. Whichever platform you're running, the install mechanism is the same. A single CLI tool called clawhub handles fetching the skill and placing it in the right directory. You don't need to learn a different process for each platform. You learn one command, and only the target directory changes.

Step 1: Install the ClawHub CLI

One command, one time:

npm install -g clawhub

The -g flag installs the CLI globally, which is what you want. This is a tool you'll use across projects, not one you install per project.

Verify it worked:

clawhub --cli-version

You should see a version number (0.9.0 at the time of writing). If you get command not found, your PATH likely doesn't include npm's global bin directory. Run npm config get prefix to find where npm installs global packages, then add the bin subdirectory of that path to your shell's PATH and restart the terminal. Use this guide if your stuck. Or ask your AI agent who can walk you through the steps.

Step 2: Pick a Skill

Browse the registry at clawhub.ai, or search from the terminal with clawhub search .

Four signals matter when picking your first skill.

Install count, not download count. Downloads on ClawHub count page views, which makes the leaderboard mostly a popularity contest. Installs tell you how many people actually added the skill to an agent. This is the number shown when you click on a skill saying "all-time" and "current". These are the important numbers.

Reviews, if they exist. A handful of honest developer reviews beats a high download count every time.

Last updated. Skills untouched for months are likely to have drifted out of compatibility with current platforms. Look for something updated in the last few weeks.

The security badge. ClawHub rolled out automated security review this year after the ClawHavoc incident, which saw over 1,400 malicious skills removed from the registry. Skills that pass review show a badge on their listing page. For your first install, stick to badged skills.

For your first skill, pick something simple. A PDF invoice parser, a meeting transcript summariser, a markdown-to-clean-notes converter. Something where you can tell immediately whether it worked. Avoid complex multi-step skills until you have one install working.

Step 3: Install the Skill

Same command, different target directory depending on your platform.

OpenClaw

The default case. Just run:

clawhub install <skill-name>

The skill lands in ~/.openclaw/workspace/skills// and OpenClaw picks it up automatically. No restart needed.

Claude Code and GitHub Copilot

Both use the same install pattern. Point clawhub at the right platform directory with the --workdir flag.

For Claude Code:

clawhub --workdir ~/.claude --dir skills install <skill-name>

For GitHub Copilot:

clawhub --workdir ~/.copilot --dir skills install <skill-name>

The skill lands in ~/.claude/skills// or ~/.copilot/skills// respectively. GitHub Copilot also reads ~/.claude/skills/ and ~/.agents/skills/ as valid personal skill directories, so any skill already installed for Claude Code will show up in Copilot too.

Reload behaviour differs. On Claude Code, if ~/.claude/skills/ didn't exist before this install, restart Claude Code so it starts watching the directory (live reload works after that first restart). On GitHub Copilot in VS Code, no action is needed. On GitHub Copilot CLI, run /skills reload in your active session.

GitHub's own gh skill install command launched in mid-April. It works for GitHub Copilot only. Use clawhub when you want one tool for every platform; gh skill is a fine alternative if you're exclusively on GitHub Copilot.

Other Platforms: Cursor and Codex CLI

The clawhub install command works across every skill-capable platform; only the target directory changes. Two more platforms follow the same pattern.

Cursor:

clawhub --workdir ~/.cursor --dir skills install <skill-name>

Target directory: ~/.cursor/skills//. Cursor also reads from ~/.agents/skills/, ~/.claude/skills/, and ~/.codex/skills/ for cross-platform compatibility, so skills installed for other agents will show up here too. Skills are detected automatically.

Codex CLI:

clawhub --workdir ~/.codex --dir skills install <skill-name>

Target directory: ~/.codex/skills//. Codex detects new skills automatically; restart Codex if one doesn't appear.

What a Successful Install Looks Like

Whichever platform, a successful install prints something like:

✔ OK. Installed <skill-name> -> <path>/<skill-name>

The target directory will contain at minimum a SKILL.md file. That's the instruction file the agent reads. If you see the OK line and the directory has a SKILL.md inside it, the install worked.

Step 4: Use It on Real Work

Don't test with a toy prompt. Pick something from your actual to-do list.

For a PDF invoice parser, feed your agent an actual invoice and ask it to pull the line items into a table. Before the install, the agent either refuses the PDF or produces broken output with missing fields. After, the skill parses the document and returns clean structured data you can paste into a spreadsheet.

You can tell when the skill is downloaded when the agent either references it by name ("Using the invoice parser skill...") or just handles the task without you telling it how. If you find yourself having to instruct the agent on how to parse a PDF, the skill isn't active. Stop and check the install.

For other skills, the test pattern is the same. Ask the agent to do the thing the skill covers. If it does the thing cleanly, the skill is working. If it defaults to generic reasoning or asks for more context, the skill isn't being triggered.

When It Doesn't Work

The install command ran but nothing visible happened.

Check the output for the OK line. If it isn't there, the install didn't complete, usually because Node.js is missing or your PATH doesn't include npm's global bin directory (view the guide linked above). Re-run clawhub --cli-version to confirm the CLI is working.

The skill installed but the agent doesn't see it.

This is the most common issue, fix depends on your platform. On Claude Code, restart the app if ~/.claude/skills/ didn't exist before this install. On GitHub Copilot CLI, run /skills reload in the active session. On GitHub Copilot in VS Code, reload the window if it isn't automatic (Cmd+Shift+P → "Reload Window"). On OpenClaw, confirm it's running and pointing at the right workspace.

The skill installed but doesn't do what you expected.

Registry descriptions can be optimistic. Open the SKILL.md in the install directory and read what it actually says. The SKILL.md is the source of truth. The registry page is a marketing copy.

A permissions prompt on first use.

Some skills need shell access or specific tools to function. Check the skill's frontmatter, and review any scripts before approving. You're giving the skill permission to run things on your machine, and any skill asking for API keys or writing files outside its own directory warrants a close read of the SKILL.md before you continue. The security badge is a useful first filter. A human read of the SKILL.md is the real check.

What to Do Next

You now have a working install. The next move: install a different skill. An agent with an invoice parser and a meeting summariser is already doing two things it couldn't this morning. Browse the registry or search with clawhub search for something that matches your actual work. The real power shows up when skills work together. If you installed a skill that parses invoices from PDFs, install one that uploads the results into your accounting workflow (Xero, QuickBooks, FreshBooks). The two skills running in sequence is what's called skill-chaining, and it turns a manual workflow into an automated one.

GitHub Copilot CLI users also have access to plugins, which bundle skills, agents, hooks, and MCP servers into a single installable unit. Worth exploring once you're comfortable with individual skills. Browse with copilot plugin marketplace browse.

Wrapping Up

That's the install workflow. One CLI tool, one command pattern, one target directory per platform. The first install is the hard one because the process is new. Every skill from here on works the same way. You've also done something most people using AI every day haven't: moved from talking to an agent to extending one. That's where the real leverage starts.

Original article: https://theskilleconomy.substack.com/p/how-to-install-your-first-agent-skill?r=7ekjvb

There's a New Market Hiding in Plain Sight

Rian O'Leary — Tue, 14 Apr 2026 15:06:28 +0000

Welcome to The Skill Economy. Market intelligence for the agent skills frontier, before the rest of the world figures it out.

Every few years a new market opens. Almost nobody notices.

Not because the data is hidden, the data is in plain sight. The people who should be writing about it are busy with whatever the last market was. Crypto. LLMs. The API economy. The app store boom before that. Each of these had a window, and during that window a handful of people figured out what was happening, worked out what to do about it, and got there early. Most people didn't.

We're in that window right now for the agent skills market. By reading this, you're already ahead of almost everyone else on the internet who doesn't know it exists. My job is to keep you there.

What Agent Skills Are

An AI agent is a program that takes goal-directed actions on your behalf. It uses a large language model as its reasoning engine and it can send emails, browse the web, write code, run commands, and dozens of other things you'd normally do yourself. The practical version of this has existed for about eighteen months, which is part of the reason most of the world hasn't caught up.

A skill is a reusable capability you install into an agent. Think of it as an app for your agent. Install a skill called "manage-calendar" and your agent suddenly knows how to check your diary, schedule meetings, and resolve conflicts. Install a skill called "review-invoices" and your agent can parse PDFs, extract line items, and log them to a ledger. Skills can be a single instruction file or a fully coded Python tool. They're distributed through registries, roughly the way apps are distributed through an app store.

The biggest public registry is ClawHub. It hosts almost 51,000 community-built skills as of today. Most are free. Some are useful. Some are broken, abandoned, or outright malicious. And right now, there is no trusted source of analysis on which ones to use, how to combine them, or what business models the ecosystem is actually producing.

That gap is why I'm writing.

Why This Is the Moment

Here's what I see happening that most people haven't clocked.

The economics of traditional service work just changed. Things that used to take a freelancer a week take a solo operator with the right skill stack a few hours. This isn't a speedup. It's a different ceiling for what one person can reach. The businesses you can run, the services you can sell, the problems you can profitably take on, all of that just shifted underneath everyone's feet, and almost nobody has looked down.

The data on the market is the part that should stop you. The Apple App Store took six months to reach 15,000 apps after its launch in July 2008, a growth curve the technology press described as unprecedented at the time. ClawHub reached the same number in four months. The wider agent skills ecosystem crossed 350,000 packages in approximately two months, a threshold the biggest software package registry on the internet took around eight years to reach. This is not a market that will form gradually over the next two years. It is forming right now, faster than the historical parallels, and the opportunities inside it are appearing and closing at the same speed.

The supply side is also thin in a way that matters. Most developers are chasing SaaS. Most consultants don't know what a skill is. Most small businesses that could benefit from agent automation have never heard of an agent. The demand side is unaware, the supply side is distracted, and the gap between the two is where every interesting early market in history has lived. The App Store in 2008. The early web. The shape is familiar. What's different is that almost nobody has started mapping the territory yet, and the window is closing faster than any of those comparisons suggest.

What You Get From Reading This

One post a week, every Tuesday, and every post is something I've read, tested, or built myself. The publication rotates through four formats so the feed reads as a publication with a worldview, not a review blog or a single-trick playbook. Each format exists because it gives you something specific you can use.

Analysis. You learn which parts of the market are actually moving and what to do about them. Which categories are opening up. Which niches are saturating. Which structural dynamics are about to become obvious. Some of these posts are data-led, grounded in ClawHub leaderboards and install metrics. Some are argument-led, making a case about where the market is going and what it means for the people operating inside it. Both kinds give you a frame for understanding the market that goes further than the numbers alone.

Teardowns. You find the skills worth installing out of almost 51,000 on the shelf. Every skill covered here gets installed and tested before a word is written about it. Last week's post reviewed the five most downloaded skills on ClawHub. Only one did anything useful. ClawHub also had a supply chain attack earlier this year in which over a thousand malicious skills were removed from the registry. The testing isn't just editorial diligence. It's what stands between a reader and a bad day.

Stack Plays. You get specific strategies for capturing specific opportunities. A solo operator running a local business web agency with four free skills. A freelancer replacing hundreds of dollars a month of SaaS with agent workflows that do the same job. A consultant opening a service line that didn't exist last year. Real workflows, real math, real pricing. The math has to work on the page or the post doesn't ship, and the strategies are the kind you can execute this week if they fit your market.

Explainers. You get from zero to operational. What a skill actually is, how ClawHub works, how skills differ from plugins or MCP tools, how to install your first one. If you arrived at this publication without knowing what any of the above meant, the Explainers are your on-ramp. By the time you've read three of them, you'll understand this market better than most of the people trying to build inside it.

The four formats rotate because the publication is doing a larger project, which is mapping an emerging market while it's still emerging and telling you what to do about it while doing so. Every post is one tool in that project. The project is what makes the publication worth subscribing to. The individual posts are how the project compounds.

Who This Is For

Anyone who suspects something interesting is happening at the edge of the AI market and wants to understand it, and act on it, before the rest of the world figures it out.

Developers looking for a new surface to build on. Founders hunting for unexplored angles. Consultants and agencies wondering how their work is about to change. Operators who want practical strategies for making money and saving money in a market most people haven't noticed. Curious outsiders who just want to know what the next wave looks like before it arrives. You might arrive here knowing nothing about this market. Three posts in, you'll have a clearer picture of it than most people on the internet will get this year.

The Invitation

The skills market is forming right now and most of the world is not paying attention. I am. Every week I'll tell you what's happening, what it means, and what to do about it before it stops being an opportunity. The posts will be honest, tested, and opinionated. The math will be real. The strategies will be ones I've worked through myself, with the caveats I actually found, not the ones that make for better copy.

By the time the wider world notices this market exists, you will already be acting on it. If you want to be one of the people who were early, subscribe.

View the Original article here: https://theskilleconomy.substack.com/p/theres-a-new-market-hiding-in-plain

The Skill Economy. Market intelligence for the agent skills frontier, before the rest of the world figures it out.

I Installed the 5 Most Downloaded Skills on ClawHub. Only One Did Anything.

Rian O'Leary — Tue, 07 Apr 2026 12:52:35 +0000

ClawHub now hosts almost 50,000 community-built agent skills. For anyone arriving fresh, "most downloaded" is the obvious filter to start with. It's how app stores have worked for fifteen years. Popular things are popular for a reason, right?

We pulled the real download and install data for the top five skills on ClawHub, then spent an afternoon installing every one of them, reading the source code, and actually testing what each one does. The results were not what we expected.

Four out of the five are instruction-only files. Two are by the same developer. One has a typo in its install command (the very first command in its setup section). And exactly one of them did something useful when we typed a command into it.

Before we get to the skills themselves, there's a number worth understanding.

The Download-to-Install Ratio

ClawHub publishes two metrics for every skill: downloads and installs. They sound like the same thing. They aren't.

A "download" on ClawHub is closer to a page view. Someone landed on the skill, clicked into it, maybe read the SKILL.md. An "install" is when someone actually ran clawhub install on their machine. The gap between those two numbers tells you how many people looked at a skill versus how many actually committed to it.

Across the top five most-downloaded skills, there are over 1 million combined downloads and just 16,937 installs. That's an average ratio of 59 downloads per install. For every person who installed one of these skills, 59 others bounced.

Some skills have much wider gaps than others. The widest in the top five has a ratio of 144 to 1. The narrowest is 37 to 1. We'll come back to what that gap actually means after we've looked at each skill.

Here's the leaderboard.

Rank	Skill	Downloads	Installs	Ratio
1	self-improving-agent	358,904	5,815	61:1
2	skill-vetter	190,826	3,774	50:1
3	ontology	154,493	1,072	144:1
4	gog	147,941	3,311	45:1
5	github	148,893	3,969	37:1

Let's go through them.

1. self-improving-agent

Install: clawhub install self-improving-agent
Downloads: 358,904 | Installs: 5,815

The most downloaded skill on ClawHub is called "self-improving-agent" and bills itself as "a self-evolution engine for AI agents." That sounds remarkable. An agent that gets smarter on its own, learning from its own runtime history, applying protocol-constrained evolution to its own behaviour.

What it actually is: a markdown filing system.

The skill ships with a 500-line SKILL.md that instructs the agent to log errors to .learnings/ERRORS.md, log successes to .learnings/LEARNINGS.md, and log feature requests to .learnings/FEATURE_REQUESTS.md. Each entry gets categorised by priority (critical, high, medium, low) and area (frontend, backend, infra, tests, docs, config). Important learnings can be "promoted" to project config files.

It's a structured note-taking template. There's no runtime intelligence, no automatic analysis, no self-modification. The agent doesn't get smarter. The agent writes things down in a folder, and only if it remembers to.

That's not a fatal criticism. Structured learning capture for agents is genuinely useful, and the SKILL.md is one of the most thoughtfully written we've seen on ClawHub. The skill extraction script is well-coded, with proper input validation and a dry-run mode. The cross-platform support (Claude Code, Codex, Copilot, OpenClaw) is a nice touch. There's a real engineer behind this.

Then we hit the install command in the documentation. It says:

\clawdhub install self-improving-agent \\

The CLI is called clawhub, not clawdhub. That's the first command in the setup section, on the most downloaded skill on the platform, and it doesn't work. Anyone copy-pasting it will get a "command not found" error before they've installed anything.

This is the kind of thing that makes you question how many of those 358,904 downloads turned into successful installs. Probably the 5,815 in the install column.

The honest take: Good concept, good code, misleading name, broken install command. The gap between "self-evolution engine" and "markdown folder with templates" is wide enough to drive a truck through.

2. skill-vetter

Install: clawhub install skill-vetter
Downloads: 190,826 | Installs: 3,774

A security scanner for ClawHub skills. Use it before installing anything, the description says, to check for red flags, permission scope, and suspicious patterns. Given the ClawHavoc supply-chain incident earlier this year, when over 1,400 malicious skills were found on the registry, this sounds like exactly what every user should install first.

We installed it. Took about ten seconds. Read the entire skill in two minutes.

It's a checklist. A single SKILL.md file with no code, no scripts, no scanning capability. It tells the agent what to look for: external curl/wget calls, credential file access, eval/exec on untrusted input, obfuscated payloads. It provides a four-step vetting process and a risk classification matrix (low, medium, high, extreme). It includes a report template you can fill out after manually reviewing a skill.

What it does not do is vet anything. There's no automation. The agent still has to read every file in the skill it's vetting and apply the checklist by hand. The "tool" is the agent's existing ability to read code, plus a piece of paper telling it what counts as suspicious.

The irony of installing a security scanner that can't actually scan anything was not lost on us.

To be fair, the checklist itself is solid. The red flags are the right red flags. The risk matrix is clear. If you've never thought about skill security before, reading this is genuinely educational. But calling it a security tool is generous. It's a "How to Spot a Suspicious Skill" PDF in markdown form.

It's also stuck at version 1.0.0 with no updates since launch, and references "ClawdHub" (with an extra D) in one place, the same typo that appears in self-improving-agent. We suspect they share a template or an author.

The honest take: Useful awareness for first-time installers. Zero automation. An agent capable of installing skills unsupervised should already know to grep for suspicious patterns.

3. ontology

Install: clawhub install ontology
Downloads: 154,493 | Installs: 1,072

This is the one. The only skill in the top five where we typed a command and something actually happened.

Ontology gives your agent a memory that actually remembers things. Not chat history, not a notes file, but a structured map of the people, projects, tasks, and events your agent has come across, and how they all connect to each other.

Say you tell your agent: "John from Acme is leading the website redesign project, and the deadline is June 1st." Without ontology, that fact lives in the chat window and disappears the moment the conversation ends. With ontology, the agent stores John as a Person, Acme as an Organisation, the website redesign as a Project, John's role as a relationship between them, and the deadline as a property of the project. A week later you can ask "what's John working on?" or "what deadlines are coming up?" and the agent has real answers, because the facts are linked together rather than scattered through old chat logs.

Out of the box it understands more than fifteen types of things your agent might want to remember: people, organisations, projects, tasks, goals, events, locations, documents, messages, accounts, devices, and several more. You can also define your own rules. For example: "every Task must have a status, and the status can only be 'todo', 'doing', or 'done'." Try to create a task with a status of "maybe" and the skill will catch it.

We tested all of this. Created a Person, queried it back, defined a Task rule, then tried to break the rule on purpose by creating a task with an invalid status. The skill caught it and refused. Thirty seconds from install to working.

It's also genuinely well-built. The code is clean and stays out of trouble. The storage format keeps a full history of every change so you never lose data. It runs on basically anything that can run Python, including a Raspberry Pi, and nothing about it reaches out to the internet.

A few honest caveats. The skill checks your data against your rules when you ask it to, not automatically when you create something, so bad data can slip in if you're not careful. Some of the fancier features mentioned in the documentation (the agent reasoning about cause and effect across your knowledge graph, for instance) are described as future goals rather than working features today. And if your graph grows very large, performance will start to suffer because the skill loads everything into memory at once. None of these are dealbreakers for a personal or small-team setup.

Here's the surprising part. Ontology has the worst download-to-install ratio in the top five, at 144 to 1. For every person who installed it, 144 others looked at the page and left. The reason becomes obvious the moment you open the SKILL.md. It's dense, full of jargon, and assumes you already know what a "typed knowledge graph" is. Most people don't, and they bounce.

There's an irony in that. The most useful skill in the top five is the one most people give up on before installing, purely because the description scares them off.

The honest take: If you want your agent to actually remember the people, projects, and commitments in your work life rather than starting fresh every conversation, install this one. It's the only skill in the top five that earns its place.

4. gog

Install: clawhub install gog
Downloads: 147,941 | Installs: 3,311

Gog gets called the Google Workspace integration for OpenClaw, and we've recommended it ourselves in previous posts. So this one was the most surprising teardown of the five, because the skill itself is barely a skill at all.

It's a 44-line SKILL.md. That's the entire thing. No code, no scripts, no Go binary. The 44 lines are a command reference card for an external tool called gog that you have to install separately via Homebrew, configure with a Google Cloud Platform OAuth project, run through a browser-based consent flow, and authenticate per-account before you can do anything.

If you already have all of that set up, the SKILL.md is a tidy cheat sheet. It documents the syntax for gmail search, calendar create, drive get, sheets append, and so on. The examples are correct. The tip about GOG_ACCOUNT as an env var to avoid passing the account flag every time is useful.

If you don't already have all of that set up, this skill does nothing to help you. There's no setup walkthrough, no troubleshooting guidance, no platform-specific notes. The install command in the docs is brew install steipete/tap/gogcli, which means if you're on Linux or Windows or anywhere without Homebrew, you're on your own. We tested on a Raspberry Pi 5, and our agent couldn't run a single command because the binary wasn't available.

The skill is by Peter Steinberger (steipete on GitHub), the founder of PSPDFKit and a well-known iOS developer with a substantial following. His name carries weight in the developer community, and we strongly suspect that's where most of the 147,941 downloads come from. People see his name, recognise it, click. The actual skill they're downloading is a cheat sheet for someone else's binary that runs only on macOS.

We're not saying gog (the tool) is bad. The underlying CLI looks excellent and the homepage at gogcli.sh is well put together. We're saying that what's on ClawHub isn't really the tool. It's a thin pointer to the tool, masquerading as a skill, hosted on a registry whose download metric counts page views.

The honest take: If you're on macOS and willing to do the OAuth setup, this is your fastest path to using gog. If you're not, the skill is documentation you can't act on.

5. github

Install: clawhub install github
Downloads: 148,893 | Installs: 3,969

If gog is a 44-line cheat sheet, github is a 48-line cheat sheet. It documents five gh commands.

The skill, also by steipete, is a thin instruction wrapper for the GitHub CLI. It covers PR checks, CI run viewing, fetching failed step logs, and a couple of gh api examples with jq filtering. The examples are correct. The --log-failed tip for debugging CI is genuinely useful. The --jq filtering note is something casual gh users might not know.

Then it ends. Forty-eight lines. The skill omits issues, repos, releases, workflows, actions, gists, secrets, environments, and roughly forty other gh subcommands. It's been at version 1.0.0 since launch and has never been updated. Meanwhile the gh CLI itself has added features.

Here's the thing. Running gh --help gives you more than this skill does. Running gh pr --help gives you everything the skill covers plus everything it omits. The skill adds almost no information over what's already in the binary you're using.

So why does it have nearly 149,000 downloads? Same reason as gog. Same author, same pattern, same trust transfer from a reputable developer's name. It's also the safest skill to install in the top five (it just documents an existing tool everyone already trusts), which is probably why it has the best install-to-download ratio in the group at 37:1.

The honest take: It's not bad. It's just barely there. If you've never used the gh CLI, this is a 30-second introduction. If you have, you already know everything in it.

What the Leaderboard Is Actually Telling You

Step back from the individual reviews and a pattern emerges.

Four out of five are instruction-only. They contain no executable code. They are markdown files telling the agent what to do or how to think. That isn't inherently bad (a well-written instruction can shape agent behaviour effectively), but it means most of the "most downloaded skills" are documentation, not tools. ClawHub doesn't visually distinguish between a skill that ships with working code and a skill that ships with a checklist. Both look the same on the leaderboard.

Two are by the same author. Peter Steinberger has two skills in the top five (gog and github), both following the same pattern of thin instruction wrappers for external CLIs, both untouched since launch. This isn't a knock on him personally. PSPDFKit is a serious product and his reputation is earned. But it's a useful reminder that on a registry where a single click counts as a download, name recognition gets compounded into ranking.

The actual #4 on the leaderboard is a near-duplicate of #1. A skill called proactive-agent (135,774 downloads) is by the same author as self-improving-agent and does almost the same thing, with an added layer of proactive learning triggers. We skipped it for this review because reviewing essentially the same skill twice felt like padding. But the ClawHub leaderboard happily lists both as separate top skills.

Only one of them works the way you'd expect a tool to work. Ontology was the only skill where we ran a command and got a result without first installing a separate binary, configuring OAuth, reading 500 lines of templates, or filling out a checklist by hand. It also had the worst download-to-install ratio in the group, because its description scares off browsers.

The most useful skill in the top five is the least committed-to.

So What Should You Actually Install?

Honestly? Don't sort by downloads.

If you're new to ClawHub, the leaderboard will steer you toward skills that are popular for reasons that have nothing to do with whether they'll be useful to you. Reputation drives downloads. Catchy names drive downloads. Being early to the registry drives downloads. Whether the skill actually does something when you install it does not, apparently, drive downloads as much as you'd hope.

Better filters to start with:

Look at install counts, not download counts. If 144 people looked at a skill and 1 installed it, that's a signal. Sometimes it's a signal that the skill is too technical for casual browsers (ontology). More often it's a signal that people clicked, read the SKILL.md, and decided it wasn't worth the disk space.
Open the SKILL.md before installing. If it's 48 lines and just documents an existing CLI, ask whether you actually need the agent to have it pre-loaded. If it's 500 lines of templates, ask whether your agent will follow the instructions or just skim them. The SKILL.md is the skill. There's no hidden value behind it.
Check for actual code. A scripts/ folder with a real executable file means the skill does something deterministic. A solo SKILL.md with no scripts means the skill does whatever the agent's LLM decides to do when it reads the markdown. Both have their place, but they are very different categories of thing, and ClawHub doesn't help you tell them apart.
Be sceptical of skills named after grand concepts. "Self-evolution engine" turned out to mean "folder of templates." "Security vetting" turned out to mean "checklist." Names on ClawHub are aspirational. Test what's underneath.

The most popular skill on ClawHub has a typo in its first command. The most useful skill in the top five is the one most people abandon before installing. The leaderboard is telling you something, just not what you think it's telling you.

Sort by downloads with caution. The number is honest about what it measures. It just doesn't measure what you probably wanted.

This post was originally published on The Skill Economy, a weekly look at the AI agent skills market.