Skip to main content

Skills API

Use skill endpoints to extend your agents with specialized capabilities.

Base URL

List skills

Returns all available skills in the marketplace. No authentication required for basic listing. When a valid session is present and agentId is provided, the response includes which skills are already installed for that user and agent.

Query parameters

Response

The rating, ratingCount, installs, and userRating fields are derived from live engagement records, not the seeded Skill columns. New skills with no user ratings return rating: 0 and ratingCount: 0. If the database is unreachable and the endpoint falls back to the default catalog, all four fields are returned as 0 (or null for userRating).

Install skill

Requires session authentication. Installs a skill on an agent.

Request body

Managed runtime resolution

When agentId does not match an existing agent row in the database, the endpoint checks whether it corresponds to the authenticated user’s managed OpenClaw runtime (openclawInstanceId). If it does, a backing agent row is automatically created in the database before the skill is installed. This allows you to install skills on managed runtimes that have not yet been explicitly registered as agents. The auto-created agent uses the following defaults:
The agent row is created via an upsert, so subsequent skill installations on the same managed runtime reuse the existing row. The same resolution logic applies to the uninstall endpoint.

Idempotency

Installs are idempotent. Repeated installs of the same skill on the same agent do not surface generic failure errors:
  • If the skill is already installed and enabled for the agent, the endpoint returns 200 OK with alreadyInstalled: true and does not redeploy.
  • If a previous install record exists but was disabled (for example, after an earlier uninstall), it is re-enabled in place and the response message reflects that the skill was re-enabled.
  • If a concurrent install causes a duplicate-key conflict at the database layer, the endpoint returns 409 Conflict with code: "already_installed" and a clear, human-readable message instead of a generic install failure.

Response

When the skill is installed and deployed to the gateway successfully:
When a previously disabled install is re-enabled:
When the skill is already installed and enabled for the agent:
When the skill is saved but the agent is offline or the gateway is unreachable:

Errors

Error responses for the 409 and 500 cases include a code field alongside error:
When a skill is blocked by safety checks, the response looks like this:
A skill install is only considered active in the runtime when "deployed": true is returned. A "deployed": false response — whether from a gateway error, an unreachable runtime, or a 2xx body the gateway client rejects (for example, a runtime that returns "success": false) — means the install is saved to the database but has not been accepted by the live OpenClaw runtime. Use the agent sync endpoint to push installed skills to the runtime and confirm they are active.

Create skill

Requires session authentication. Creates a new custom skill in the marketplace. The skill becomes available to all users once created.

Request body

Response

Errors

Uninstall skill

Requires session authentication. Removes a skill from an agent.

Request body

Response

Errors

The uninstall endpoint returns { "success": true } even when no matching installation exists. It does not return a 404 error for missing skill installations, though it does return 404 if the agent itself cannot be found.
When a skill is uninstalled, the updated agent state is automatically synced to the OpenClaw gateway. If the sync fails, the skill is still removed from the database — you can retry the sync manually using the agent sync endpoint.

Download skill

Requires session authentication. Downloads a skill as a portable JSON manifest. Use this endpoint when a user wants to export a packaged skill (handler code, MCP server config, or widget configuration) instead of installing it directly to a runtime. The response is delivered as a file download with Content-Disposition: attachment and a slugified filename derived from the skill name.

Path parameters

Response

Returns a JSON manifest with Content-Type: application/json; charset=utf-8 and Cache-Control: no-store:

Response headers

The filename slug is derived from the skill name: lowercased, non-alphanumeric characters replaced with -, leading and trailing - trimmed, and capped at 80 characters. Skills with names that slugify to an empty string fall back to agentbot-skill.

Side effects

Each successful download increments the skill’s downloads counter by 1. The increment is best-effort and does not fail the download if the database update errors.
This endpoint returns the package only when the skill has at least one downloadable component: non-empty handler code, an MCP server (mcpEnabled: true), a widgetUrl, or a widgetConfig. Catalog-only skills without any of these fields return 404 with a message directing the caller to use install instead. Check the hasDownload field on the list skills response to determine whether a skill supports download.

Errors

Rate skill

Requires session authentication. Submits or updates the authenticated user’s rating for a skill. Each user has at most one rating per skill — re-posting overwrites the previous rating in place. After the rating is recorded, the skill’s average rating is recomputed from all SkillRating rows and persisted on the skill record so it is reflected immediately in subsequent GET /api/skills responses.

Path parameters

Request body

Response

Errors

Verify skill

Runs a marketplace safety scan on a skill without creating or installing it. Use this endpoint to check whether a skill would pass safety checks before submitting it to the marketplace. No authentication required.

Request body

Response

Errors

Scan object

Every skill listed, created, or verified includes a scan object from the marketplace safety scanner. The scanner performs static analysis on skill code to detect potentially dangerous patterns.

Trust tiers

Blocked patterns

The following patterns in skill code cause a skill to be blocked:
  • Piped shell execution (curl ... | bash)
  • Dynamic code execution (eval(), Function())
  • Process execution imports or calls (child_process, exec, spawn)
  • Destructive filesystem commands (rm -rf)
  • Direct environment variable access (process.env)
  • Direct IP-based remote endpoints

Available skills

Streaming

Events

Payments

Finance

Productivity

Communication

Development

Channels

Music

Creative

Marketing

AI

Production availability

The following skill routes are demo-only and are disabled in production by default:
  • Booking Settlement (/booking-settlement)
  • Demo Submitter (/demo-submitter)
  • Event Scheduler (/event-scheduler)
  • Event Ticketing (/event-ticketing)
  • Festival Finder (/festival-finder)
  • Groupie Manager (/groupie-manager)
  • Instant Split (/instant-split)
  • Royalty Tracker (/royalty-tracker)
  • Setlist Oracle (/setlist-oracle)
  • Track Archaeologist (/track-archaeologist)
  • Venue Finder (/venue-finder)
When called in production without the ENABLE_DEMO_SKILLS environment variable set to true, these routes return 501 with the following response:
To enable demo skill routes in production, set the ENABLE_DEMO_SKILLS=true environment variable. In non-production environments, all skill routes are available without this flag.

Use a skill

Visual Synthesizer

Track Archaeologist

Setlist Oracle

Groupie Manager

Royalty Tracker

Demo Submitter

Event Ticketing

Event Scheduler

Venue Finder

Festival Finder

Booking Settlement

Manage booking escrow, fund releases, and settlement simulations. Actions: list, get, create_escrow, release_funds, simulate_settlement

Instant Split

Execute royalty splits instantly in USDC on Base. Actions: list_pending, create_split_rule, execute_split, get_balance, simulate

Response format

Each skill returns additional data specific to its function alongside the success field.

Errors