Identity and maintenance
Confirm the owner, plugin id, license, releases, recent maintenance, issue history, and documentation links.
Plugins intent
Plugins execute runtime code and can register tools, channels, hooks, services, providers, and commands. Treat the GitHub review as part of the installation—not an optional extra.
openclaw plugins install git:github.com/owner/repository@ref. Pin a reviewed release tag or commit when practical, then inspect the runtime registration after installation.openclaw plugins search "calendar"
openclaw plugins install git:github.com/owner/[email protected]
openclaw gateway restart
openclaw plugins inspect <plugin-id> --runtime --json
openclaw plugins list --enabled --verbose
The example tag is illustrative. Use a revision that exists in the repository and that you have reviewed.
Runtime trust
Confirm the owner, plugin id, license, releases, recent maintenance, issue history, and documentation links.
Inspect the OpenClaw plugin manifest, package dependencies, install scripts, native binaries, and declared capabilities.
Identify every API key, OAuth permission, filesystem path, executable, host, and remote service the plugin can access.
Use runtime inspection to prove which tools, hooks, Gateway methods, services, and commands actually loaded.
| Source | Use it when | Example |
|---|---|---|
| ClawHub | You want native discovery, scans, versions, and install hints | openclaw plugins install clawhub:package |
| GitHub | You need a specific branch, tag, or commit from a reviewed repository | openclaw plugins install git:github.com/owner/repo@ref |
| npm | The publisher distributes a package through the npm registry | openclaw plugins install npm:@scope/package |
| Local link | You are developing the plugin on the same machine | openclaw plugins install --link ./my-plugin |