How It Works

Architecture & Skills System

OpenClaw — AI-assisted Coding Community · February 2026

Architecture Overview

Key insight: The LLM returns tool calls — the Gateway executes them locally. Your infra never talks to the LLM directly.

Message Flow

1. You send a message

"Scale redquiz to 3 replicas"

2. Gateway routes it

Authenticates the channel
Loads workspace context
Prepares system prompt

3. LLM reasons

Reads your request
Checks available skills
Decides what tools to call

4. Gateway executes tools

exec: kubectl scale 
  deployment/redquiz 
  --replicas=3

5. Results flow back

Gateway sends output → LLM
LLM summarizes
Gateway routes response

6. You see the result

"Done! Scaled redquiz to 3 replicas. Pods coming up now."

What the LLM Sees

Every message includes rich context automatically:

Context	Source	Purpose
AGENTS.md	Your workspace	How to behave, memory rules
SOUL.md	Your workspace	Personality, tone, values
USER.md	Your workspace	Who you are, preferences
TOOLS.md	Your workspace	Local secrets, server IPs, credentials
Skills	System + custom	Available capabilities
Memory	memory/*.md	Conversation history, notes

        This is why OpenClaw feels different: It's not starting from zero. 
        It knows your infrastructure, your preferences, your tools.
    

Built-in Tools

These are always available — no configuration needed:

Core

exec — Run any shell command
read/write/edit — File operations
web_search — Brave Search API
web_fetch — Fetch URLs as markdown
browser — Browser automation

Memory

memory_search — Semantic search (via embeddings)
memory_get — Read memory files

Embeddings turn text into vectors that capture meaning — so "deployment decision" finds notes about "agreed to ship Friday".

Scheduling

cron — Schedule tasks, reminders
sessions_spawn — Background agents

Communication

message — Send to channels
tts — Text to speech
nodes — Mobile device control

The Skills System

Skills teach the LLM how to use specific tools.

What's a Skill?

A markdown file (SKILL.md)
Documents a CLI or API
Includes usage examples
May bundle helper scripts

How It Works

You ask about GitLab pipelines
LLM sees "gitlab" skill exists
LLM reads SKILL.md
Now knows exact commands to run

        Think of it as: Just-in-time documentation the LLM reads when it needs a specific capability.
    

Skill Discovery

The system prompt includes a skill index:

<available_skills>
  <skill>
    <name>gitlab</name>
    <description>GitLab CI/CD: pipelines, jobs, logs, artifacts.</description>
    <location>~/clawd/skills/gitlab/SKILL.md</location>
  </skill>
  <skill>
    <name>hetzner</name>
    <description>Hetzner Cloud: servers, metrics, firewall.</description>
    <location>~/clawd/skills/hetzner/SKILL.md</location>
  </skill>
  <skill>
    <name>weather</name>
    <description>Get current weather and forecasts.</description>
    <location>/opt/openclaw/skills/weather/SKILL.md</location>
  </skill>
  ...
</available_skills>

Rule: The LLM only reads a skill file when the task matches its description. Keeps context lean.

        Why XML? LLMs are trained heavily on HTML/XML. They parse it reliably with clear start/end boundaries — 
        fewer ambiguity errors than YAML or JSON. The token overhead is minimal compared to parsing reliability.
    

Anatomy of a Skill

skills/gitlab/
├── SKILL.md          # The documentation the LLM reads
└── gitlab-ci.sh      # Helper script (optional)

# SKILL.md structure:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# GitLab CI/CD Skill

## Overview
Query GitLab CI pipelines, jobs, and logs.

## Authentication
Token at: ~/.gitlab-token

## Commands

### List pipelines
```bash
./gitlab-ci.sh pipelines <project>
```

### Get job log
```bash
./gitlab-ci.sh log <project> <job-id>
```

## Examples
"Show me the latest pipeline for redquiz" →
  ./gitlab-ci.sh pipelines gutschilla/redquiz
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Where Skills Come From

Source	Location	Examples
Built-in	`/opt/openclaw/skills/`	weather, web_search, himalaya (email)
Your workspace	`~/clawd/skills/`	gitlab, hetzner, k8s, inwx-dns
Community	clawhub.com	Shared skills (coming soon)

Creating a New Skill

Create folder: ~/clawd/skills/my-tool/
Write SKILL.md with commands and examples
Optionally add wrapper scripts
Done! The LLM will discover it automatically.

        Pro tip: I created all my custom skills using the AI itself — didn't write a single line of code manually. 
        Just described what I needed, and it wrote the SKILL.md and helper scripts. You can even version them in a separate repo.
    

Real Example: INWX Skill

Domain management with 2FA — from the demo:

# SKILL.md (excerpt)

## Authentication
- User: gutsch.it  
- Password: in TOOLS.md
- **2FA Required**: Ask user for OTP each time

## Commands

### List domains
```bash
INWX_USER="..." INWX_PASS="..." INWX_OTP=<code> \
  python3 ~/clawd/tools/inwx-dns/inwx-dns.py list
```

### Check domain expiry
```bash
... inwx-dns.py info <domain>
```

## Notes
- OTPs expire in ~30 seconds
- Always ask user for fresh OTP before API calls

Result: Claude knows it needs to ask for OTP, runs the command, parses the result.

The Magic Moment

"When do my production domains expire?"

The LLM's reasoning:

User wants domain expiry info
Need to know which domains → check k8s ingresses
Need expiry dates → use INWX skill
INWX needs 2FA → ask user for OTP
Run query, parse results, flag risks

Cross-system correlation — that's not a script. It's reasoning about which tools to combine.

System Properties

Separation of Concerns

LLM = reasoning, planning
OpenClaw = routing, auth, execution
Skills = domain knowledge
Tools = actual capabilities

Context Efficiency

Skills loaded on-demand
Only relevant context injected
Memory is searchable, not dumped

Extensibility

Add a skill = add a markdown file
No code changes to OpenClaw
The LLM figures out the rest

Security Model

Tool execution runs locally (your machine)
LLM can be cloud (Claude, GPT) or local (Ollama)
You control what tools exist

Credential Storage

Risk: LLM sees tokens → prompt injection could exfiltrate

Plain text (TOOLS.md) — simple, fine for isolated setups
Wrapper scripts — inject secrets at runtime, LLM only sees the command
Keyring / secret manager — LLM can't read directly
Env vars — not in prompt context

Architecture Summary

Layer	What It Does
Channels	Signal, Telegram, Discord, Webchat, TUI — where you talk
Gateway	Routes messages, manages sessions, loads context
LLM	Reasons about your request, decides what tools to use
Skills	Just-in-time docs for specific tools
Execution	Shell commands, APIs, file operations — on your machine

The key insight:

Skills are just markdown. The LLM reads them when needed. You teach it new capabilities by writing documentation.

💡 The TUI is incredibly powerful on a big screen — full path completions, syntax highlighting, and you see the AI working in real-time.

Cost & Hardware

For real work, you need capable models — that's not free.

Option	Cost	Notes
Claude Pro	$20/month	Good for daily use, rate-limited
Claude Max	$100+/month	Heavy use, Opus 4.5 access
API (pay-as-you-go)	~$15/M tokens (Opus)	Best quality, no rate limits
Local (Ollama)	Hardware once	RTX 3090 or Mac Mini M4 (~€2500)

Embeddings (for memory_search)

Semantic memory search requires an embedding model:

OpenAI — A few dollars covers months of use (embeddings are cheap)
Local via Ollama — nomic-embed-text or mxbai-embed-large, zero API cost

        Reality check: Local models (even on beefy hardware) are faster but noticeably worse 
        than Opus 4.5. I'm currently using Opus via API — the quality difference is real.
    

Outlook

What I'd love to try

Running OpenClaw on my company-provided Mac

Using company-approved LLM providers (for security & compliance)
For RedCare work — code reviews, documentation, infra queries
Credentials never leave corporate boundaries

Potential providers

OpenAI Codex — should work, haven't tried yet
Azure OpenAI — enterprise compliance
Amazon Bedrock — Claude in your VPC
Self-hosted — Ollama on internal GPU servers

Thanks!

Open for Questions

5:00

github.com/openclaw/openclaw

How It Works

Architecture & Skills System

Architecture Overview

Message Flow

1. You send a message

2. Gateway routes it

3. LLM reasons

4. Gateway executes tools

5. Results flow back

6. You see the result

What the LLM Sees

Built-in Tools

Core

Memory

Scheduling

Communication

Meta

The Skills System

What's a Skill?

How It Works

Skill Discovery

Anatomy of a Skill

Where Skills Come From

Creating a New Skill

Real Example: INWX Skill

The Magic Moment

System Properties

Separation of Concerns

Context Efficiency

Extensibility

Security Model

Credential Storage

Architecture Summary

Cost & Hardware

Embeddings (for memory_search)

Outlook

What I'd love to try

Potential providers

Thanks!

Open for Questions