OpenClaw Major Update: Introducing the ClawHub Skill Marketplace, One-Click Import of Claude, Codex, Cursor Plugins

According to 1M AI News monitoring, the open-source AI Agent platform OpenClaw has released version v2026.3.22. The key change in this update is the launch of the ClawHub Skill Marketplace. The `openclaw plugins install` command now prioritizes searching for packages on ClawHub, supporting the full process of skill search, installation, and version updates. Another notable enhancement is cross-ecosystem compatibility: OpenClaw can now directly discover and import plugin packages from the three major platforms Claude, Codex, and Cursor, automatically mapping their skills to run in the OpenClaw format. Additionally, support has been added for Claude marketplace registration resolution and plugin@marketplace installation method.

Web search capabilities have been expanded simultaneously, with the integration of the Exa, Tavily, and Firecrawl three major search and web crawling services as built-in plugins, eliminating the need for user configuration. On the model provider front, Anthropic Vertex AI (which calls Claude through Google Vertex AI) and Chutes provider have been added, Xiaomi MiMo V2 Pro and V2 Omni have been onboarded, the MiniMax default model has been upgraded from M2.5 to M2.7, and the OpenAI default model has been switched to gpt-5.4. The sandbox execution environment has introduced a pluggable backend architecture, initially offering two backends: SSH and OpenShell, no longer limited to Docker.

A security fix has addressed a vulnerability on the Windows platform where attackers could trigger SMB credential leakage through crafted local media input. Sandbox environment blocking has been added for JVM injection (`MAVEN_OPTS`, etc.), glibc exploitation (`GLIBC_TUNABLES`), and .NET dependency hijacking (`DOTNET_ADDITIONAL_DEPS`). The Plugin SDK has undergone a complete refactoring to enable import via the openclaw/plugin-sdk/* subpath, with the old openclaw/extension-api being removed without compatibility shims. Historical brand legacies have also been cleaned up: all CLAWDBOT_* and MOLTBOT_* environment variables support and automatic migration of the .moltbot status directory have been removed.