ZeroClaw Skills
The official skill registry of the ZeroClaw agent: ready skills for code, chats, data and DevOps, with trust tiers
- 65 ★ on the repository
- Last commit
Broad access
Why this level
- Community skills get no behavioral review, and the `shell_exec` and `file_write` permissions let them run commands and write files
- Skills for email, Slack and Discord act in the user's name
- The SQL executor runs queries against PostgreSQL or Supabase
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/zeroclaw-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Community skills get no behavioral review, and the `shell_exec` and `file_write` permissions let them run commands and write files
- Skills for email, Slack and Discord act in the user's name
- The SQL executor runs queries against PostgreSQL or Supabase
This is third-party code. Review the repository files before installing.
What it does
The zeroclaw-labs registry collects skills for the ZeroClaw agent in the agentskills.io specification format: each skill sits in its own folder with a `SKILL.md` and a description. Categories: agents, coding, research, writing, chat, security, data, DevOps and tools. Every skill carries a trust tier: `Official` for skills by the zeroclaw-labs team and `Community` for those sent in by the community. Official ones include autonomous code generation, review, documentation, web research, a RAG knowledge base, a router between sub-agents and connections to Telegram and Slack. Third-party ones include Discord moderation, an SQL executor, email replies and working with X data through Xquik. A skill is installed with `zeroclaw skills install <skill-name>`. Before installing an unfamiliar skill, run `zeroclaw skills audit <name>` and read its `SKILL.md`. The collection can be browsed on the Skills Hub page.
Who it is for. ZeroClaw users who want a ready skill for code, chat or data without writing their own prompts.
Good fit when
- ZeroClaw needs code review or documentation generation and you do not want to write a skill from scratch
- The agent connects to Telegram, Slack or Discord and a ready skill exists for the channel
- A team prepares its own skill and takes the `SKILL.md` structure and permission list as a model
- A third-party skill has to be checked before install with `zeroclaw skills audit`
Not a fit when
- You work in Claude Code or Cursor: `zeroclaw skills install` installs skills into ZeroClaw
- You need a security guarantee: the registry does not audit skill code, and CI looks only for pattern signs
- The skill you need is not on the list: the registry is small, and new ones arrive through a pull request
Example request
Run the audit command on the `web-researcher` skill from the ZeroClaw registry and tell me which permissions it asks for before installing.Limitations
The registry is not a security boundary: pull request checks look for secrets, dangerous patterns and structure errors, and nobody checks a skill's behavior at run time. Community skills come from outside authors, and the registry makes no claims about their intent.
Some entries in `registry.json` carry the author `community` as a placeholder. ZeroClaw itself must be installed, and a skill's permissions, such as `file_write` or `shell_exec`, are set in its `SKILL.md`.
How to disable. The registry documentation describes no removal command; a skill is removed with ZeroClaw's own tools.
FAQ
How do I install a skill from the ZeroClaw registry?
With `zeroclaw skills install <skill-name>`. Before that, run `zeroclaw skills audit <name>` and read the skill's `SKILL.md`.
How do Official and Community differ?
Official skills are made and maintained by the zeroclaw-labs team, Community skills come from outside authors. The contribution rules are the same, but the registry does not vouch for Community authors.
What checks does a skill pass?
Structure (frontmatter fields, a license from the SPDX list, folder name match) and security: scanning for secrets, dangerous commands and suspicious URLs. Combinations of `shell_exec` with network access and `file_write` with `shell_exec` are not allowed. It is a baseline filter, not an audit.
Can I add my own skill?
Yes: fork the repository, add a `skills/<name>/` folder with `SKILL.md` and a README, add a line to `registry.json` and open a pull request. Licenses from the list in the documentation are accepted, for example `MIT` and `Apache-2.0`.
What should I do about a suspicious skill?
Report it by the procedure in the registry documentation. The registry removes malicious skills and publishes an advisory, but there is no continuous audit.
Discussion
No questions or reviews yet.
Related
SkillsAn open catalogue of over three thousand skills, each backed by a real project, with industry collections and categories.
The clawskills CLI searches an index of 125,000 skills and installs matches into Claude Code, Cursor, Codex and OpenClaw folders.
A command-line skill manager: installs skills from a marketplace, GitHub, private Git and npm into 45 agents' folders and scans them first
A skill registry for teams with security scanning and versioning; the MCP server finds and installs skills on request.
A catalog of nearly two hundred skills: code delivery, review, debugging, AI governance, product work and agent coordination.
A Go terminal UI for agent skills: list, check, update and find new ones in a single window
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| ZeroClaw Skills (this card) | yes | 65 | |
| Yandex Direct, Metrica and Wordstat skill | no | 1 | a collection of skills for another agent, OpenClaw |
| Custom skills bundle for Hermes Agent | no | 1 | skills for the Hermes agent |
README in short
The documentation explains the trust tiers, installation and browsing in the Skills Hub. Most of it is a guide for authors: fork, skill structure, frontmatter fields, categories, accepted licenses, permissions and `registry.json` rules. The last section describes what the two automated workflows check and how to report a malicious skill.