Skip to content
Agent Selector
All guides

What Are AI Agent Skills? (OpenClaw, ClawHub & Hermes)

TL;DR: "Skills" are modular abilities you add to an agent so it can do new things (send email, browse, deploy code). Some agents install skills from a marketplace like ClawHub (OpenClaw); others, like Hermes Agent, write their own. Powerful — but installing untrusted skills is a real security risk. Vet everything.

How agents get new skills

  • Skill marketplaces — install community-made skills. OpenClaw's ClawHub hosts 13,000+ skills (Gmail, calendar, browser automation, deploys, and more). Each skill is a file with instructions the agent follows.
  • Self-writing agents — Hermes Agent refines and writes its own skills from experience instead of installing them.
  • MCP (Model Context Protocol) — an open standard for connecting agents to tools/data; many modern agents support MCP servers as "skills."

⚠️ The security catch

Skills run with your agent's access. A ClawHub audit found roughly 12% of scanned skills were malicious, and OpenClaw saw multiple severe CVEs in early 2026. Treat third-party skills like installing random software:

  • Read the skill before installing
  • Grant least-privilege access
  • Prefer well-reviewed, popular skills
  • Keep a human approval step for sensitive actions

Should you use skill-based agents?

If you're technical and want maximum extensibility, yes — with caution. If you want safety and simplicity, a managed agent with vetted connectors is lower-risk. Compare your options →

Related

Frequently asked questions

What are AI agent skills?

Modular abilities added to an agent so it can perform new tasks. Some agents install skills from marketplaces like ClawHub; others, like Hermes, write their own.

What is ClawHub?

ClawHub is OpenClaw's marketplace of 13,000+ community skills. It's powerful but has hosted malicious skills, so vet every skill before installing.

Are AI agent skills safe?

Not automatically - skills run with your agent's access and untrusted ones can be malicious. Read skills before installing, use least-privilege access, and keep approval gates.

Not sure which agent fits? Get matched in 2 minutes.

Start the selector