OpenClaw Plugins Marketplace: Vet Community Extensions

The useful question is not “Which OpenClaw plugin is the best?” It is “What would this extension be able to reach if I enabled it here?” A community listing can save discovery time, but the listing does not tell you whether the package is a skill, a native plugin, or a bundle with a wider execution surface. That classification changes the review you need.

OpenClaw’s own security guidance treats third-party skills as untrusted code and asks operators to read them before enabling them. The project’s security policy is more direct about native plugins: installing or enabling one gives it the trust level of local code on the Gateway host. The rest of this page turns those warnings into a repeatable decision path rather than a popularity list. See the skills security guidance and the project security policy.

Classify the artifact before you assess it

The distinctions come from the plugin manifest reference and bundle documentation. A package can expose more than its short marketplace name suggests, so do not approve it from the name alone.

Record provenance before installation

Write down the owner or publisher, the exact source locator, the version or commit, the digest or integrity information, the scan state, and who will own updates. ClawHub, official packages, npm, Git, local archives, and marketplace locators are different source paths. The install command can preserve origin and integrity metadata, but that record proves which artifact you received; it does not prove that the artifact behaves safely.

Use explicit locators when the source matters. The current CLI reference documents patterns such as:

The install reference says arbitrary npm, Git, local, archive, and marketplace sources require an explicit review step. The --force flag confirms a source or overwrites a target; it does not bypass the security install policy or capability checks. Prefer a pinned version or commit for a trial so that a later update cannot silently change the object you reviewed.

Read the declared capability surface

OpenClaw asks for capability consent when a third-party plugin is installed or enabled. That consent can expose channels, providers, tools, hooks, MCP servers, CLI commands, backends, skills, and dangerous configuration flags. Compare every declaration with the one task you actually want to perform. If a calendar helper asks for shell execution, broad filesystem writes, message sending, or a credential it does not need, stop and ask why.

For native plugins, open openclaw.plugin.json before runtime loading. The manifest can declare dependencies, channels, providers, setup steps, MCP servers, CLI commands, skills, and compatibility contracts. For a skill, read the complete SKILL.md and inspect every referenced script, URL, package, environment variable, and workspace path. The skills reference also separates “eligible to load” from “authorized to call a tool”; a visible skill is not a grant of permission.

Keep the cold inventory separate from the runtime result. The plugin management documentation describes a cold list and a runtime inspection because importing a module can execute code. Do the static read first, then use runtime inspection only in a disposable environment. See Manage plugins for the consent and inspection boundaries.

Use scans as evidence, not a green light

For skills, the CLI provides search, information, checks, verification, cards, and update operations. An owner-qualified ClawHub reference reduces publisher ambiguity. A pending scan, a failed verification, a “not scanned” Git source, or a local path with no registry record is a reason to defer the trial until you can review the files yourself.

Before a bounded test, run the deep security audit. The audit documentation says that openclaw security audit --deep adds plugin and skill code-safety scans and live Gateway probes. A scan can report findings and failures; it is not an automatic approval. A research preprint on ClawHub signals also reports disagreement between VirusTotal, static analysis, and semantic analysis, which is a useful reminder to keep layered checks. Read the audit checks and the published preprint for the limits of a single detector.

Version gates matter too. A historical GitHub advisory describes arbitrary code execution through an older local plugin or hook installation path and identifies OpenClaw 2026.3.24 as the fixed release. That record is not a claim that every current install is affected; it is evidence that the version, source path, and install behavior belong in the review record. See the advisory.

Set the boundary before the first real run

Choose the sandbox, tool policy, workspace, network access, and account before the extension sees data. OpenClaw’s boundary guide separates these decisions: sandboxing chooses where tools run, tool policy chooses which tools can be called, and elevated execution cannot override a denied tool. A bind mount or a different backend can change the effective boundary, so record the actual configuration instead of assuming that “sandboxed” means isolated.

For an unknown skill or bundle, use a disposable workspace, dummy files, no production credentials, and the smallest tool allowlist that can answer the question. For a native plugin, use a separately trusted host or user when the package is not already part of your organization’s trusted codebase. The plugin itself runs with the Gateway host’s operating-system privileges; an agent-side sandbox does not contain that in-process code. See Sandbox vs tool policy vs elevated and the plugin trust boundary.

A small, repeatable trial

1. State the job. For example: “Summarize three dummy Markdown files into one local report.” Do not begin with a broad request such as “manage my workspace.”
2. Capture the cold state. Save the owner, source, version or commit, manifest, declared capabilities, scan result, and the files you reviewed.
3. Run once with fake data. Watch file reads, writes, network calls, messages, and process launches. A plausible answer is not proof that the boundary held.
4. Check the output. Confirm that it touched only the expected directory, used no real secret, and produced the requested artifact without extra side effects.
5. Decide explicitly. Install for a narrow task, keep it in the disposable environment, defer it pending evidence, or reject it. Record the reason so a future update does not reopen the same question.

This is also a good place to link the site’s OpenClaw gateway security audit runbook for the recurring checks around channels, pairing, and remediation ownership.

Know when to defer or reject

• Defer an unpinned artifact, an ambiguous publisher, a pending or failed scan, or a package whose update path you cannot reproduce.
• Defer a native plugin that requests capabilities outside its stated task, especially host commands, broad filesystem access, or production credentials.
• Reject a skill that hides its scripts, downloads another payload without explanation, asks for secrets in prompts, or treats a scanner result as a substitute for review.
• Reject a trial that cannot be run with dummy data and a bounded workspace. If the only proof requires your real mailbox, repository, or cloud account, the test is too wide.

Plan updates and rollback before adoption

Updates are a second review, not a housekeeping detail. Preview a plugin update with its dry-run option, compare the new source and capabilities with the recorded state, then approve the change deliberately. Uninstall also supports a dry run and a keep-files choice; use those before removing a package that may have dependents. The update and uninstall reference documents those paths and the diagnostic behavior when finalization fails.

Keep a verified backup and a tested recovery procedure. The rollback guide separates package downgrade from configuration and data recovery: downgrading a package does not reverse migrations. That means a plugin decision should include the backup location, the owner for recovery, and the condition that triggers a rollback. See Rollback and recovery.

The marketplace is a starting point, not a verdict

A useful OpenClaw extension is one whose source, capabilities, boundary, and maintenance path you can explain in one page of notes. Start with the narrowest task, keep the first run disposable, and promote the artifact only when the evidence matches the access it needs. That habit scales better than a static list of “must-have” plugins, because the package, its maintainer, and your Gateway configuration can all change.

Sources

• Skills and third-party skill security
• Skills CLI, verification, and scan states
• Plugin capability consent and inspection
• Plugin sources, compatibility, and integrity
• Native plugin manifest
• Plugin bundles
• Sandbox, tool policy, and elevated execution
• Deep audit checks
• Plugin updates and uninstall
• Rollback and recovery
• OpenClaw security policy
• Historical plugin installation advisory
• ClawHub security-signal preprint