OpenClaw v2026.5.28-beta.1: Skill Workshop, Workboard, Tokenjuice, and the Copilot Plugin Go Official
OpenClaw's May 31 pre-release is one of the most structurally ambitious drops in weeks: a full Skill Workshop proposal lifecycle with scanner and rollback safeguards, a new Workboard orchestration layer for multi-agent planning, and the externalization of both Tokenjuice and the GitHub Copilot agent runtime as official first-class plugins. Meanwhile the broader news cycle has never been louder — Sam Altman publicly endorses signing into OpenClaw with a ChatGPT account, Gemini Spark goes live as Google's direct cloud-based answer, and the iOS push relay gets a production-grade upgrade.
🦞 OpenClaw Updates
v2026.5.28-beta.1: The Skill Workshop Is Now Real Infrastructure
This morning's pre-release, timestamped 31 May 02:39, lands with a cluster of changes that point in a clear direction: OpenClaw is turning skills from a convenience layer into a governed infrastructure concern. The most substantial addition is the Skill Workshop — a full proposal lifecycle for community-contributed skills, built around the skill_research agent tool.
Here is what the Skill Workshop actually does, in plain terms. Community contributors can now submit skill proposals as pending PROPOSAL.md drafts. Those proposals carry versioned, dated frontmatter and can be revised in place before approval. The skill_research agent tool can then apply, reject, or quarantine proposals through a guarded lifecycle — meaning a human or automated review step must happen before a skill gets deployed. Approved proposals support standard skill folders with scanner, hash, and rollback safeguards baked in.
This is a meaningful shift. Until now, skill creation in OpenClaw was a relatively informal process: write a SKILL.md, publish to ClawHub, and trust that VirusTotal scanning would catch problems. The Skill Workshop adds an explicit proposal stage with quarantine paths, rollback metadata, and scanner verification before anything lands. For operators running production OpenClaw instances, this matters significantly — it gives you a way to require review on new or updated skills before they become available to your agents.
Credit to contributor @shakkernerd across the Skill Workshop changes. This is the kind of community-driven safety infrastructure that strengthens the whole ecosystem.
Workboard: Multi-Agent Planning Gets a First-Class Orchestration Surface
The second big addition is the Workboard — a new set of orchestration primitives and agent coordination tools for multi-agent planning and run tracking. The release notes describe it as adding "orchestration primitives and agent coordination tools for multi-agent planning and run tracking" with its own dedicated surface.
OpenClaw has had TaskFlow-style multi-agent patterns for a while, but the Workboard frames them differently: this is about coordination, not just spawning subagents and waiting for results. Think of it as a shared planning layer where agents can register work, track progress, and hand off between each other with explicit state. That is the kind of infrastructure that makes multi-agent workflows not just possible but observable and debuggable.
For operators who have been running manual antfarm-style workflows or chaining cron jobs together, the Workboard is worth watching closely. It signals that OpenClaw is thinking seriously about the "who is doing what, and how does a human know?" problem in multi-agent setups.
The Skill Workshop and Workboard together tell a coherent story: OpenClaw is systematically adding governance surfaces to areas that were previously informal. Skills get a proposal lifecycle. Multi-agent work gets a coordination layer. Neither of these is a glamorous user-facing feature, but both of them are exactly what separates a toy system from production infrastructure. This is the right kind of boring.
Tokenjuice and GitHub Copilot Become Official Plugins
Two major capabilities have been externalized as first-class plugins in this release:
@openclaw/tokenjuice is now a standalone npm package with ClawHub publish metadata. Tokenjuice is OpenClaw's token-budget and cost-management layer — the system that helps agents track and govern their token consumption across model calls. Moving it out of the core and into an explicit versioned plugin makes it easier to update, audit, and configure independently.
@openclaw/copilot externalizes the GitHub Copilot agent runtime with npm and ClawHub publish metadata. The Copilot plugin was previously bundled implicitly; it is now a discrete package with a clean installation path. This matters for operators who want to use Copilot as an ACP harness without pulling the full bundled stack.
Together with the earlier externalization of PixVerse, Meeting Notes, and other capabilities, these moves are part of a systematic architectural shift: the core OpenClaw package gets leaner, and capabilities you opt into get their own packaging, versioning, and lifecycle. The right engineering direction for a project at this scale.
iOS Push Relay, Realtime Talk, and Mobile Gets a Production Upgrade
The iOS side of this release is also worth noting. OpenClaw now includes hosted push relay defaults, realtime Talk playback, and a guarded WebSocket ping path for more reliable mobile sessions. In practical terms: if you have been experiencing intermittent iOS notification delivery or Talk session drops on mobile, this release directly addresses those failure modes.
The WebSocket ping path in particular is a sign of mature mobile engineering. Keeping a long-lived connection alive through NAT, VPN, and mobile radio state changes is notoriously tricky. Adding a guarded ping path with proper lifecycle management means the gateway can maintain the connection without hammering the device or leaking state on close.
Code Mode, Dreaming UI, and SecretRef
Three more additions round out the feature set:
Code mode now supports internal namespaces for scoped agent and global sessions with exact namespace tool dispatch. This is relevant for operators running Code mode in multi-tenant or multi-project configurations — it prevents namespace collisions between concurrent coding sessions.
Control UI gains a Dreaming-tab agent selector, contributed by @stevenepalmer. The selected agent now propagates through Dreaming status, diary, and diary actions — so if you have multiple named agents with separate memories, you can inspect their dreaming state independently. This is a polish win for power users.
SecretRef adds a provider integration manifest contract and extracts shared LLM core packages for provider and plugin reuse. SecretRef handles how OpenClaw references and resolves secrets (API keys, credentials) without embedding them directly. The manifest contract formalizes how plugins declare their secret dependencies — a useful step for plugin authors and a security-hygiene improvement for operators.
Reliability Everywhere: Channels, Providers, Cron, and the CI Pipeline
The rest of the release notes are a long, dense list of fixes and timeouts that add up to a more reliable runtime. The summary from the release itself:
"Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bindings, compaction handoffs, and media delivery retries."
"Provider and plugin requests now bound more timers, retries, OAuth/device-code lifetimes, media downloads, local service probes, and generated-content polling paths before they can hang a run."
The channel hardening covers Telegram, WhatsApp, iMessage, Slack, Discord, Microsoft Teams, Google Chat, Google Meet, and iOS realtime Talk. The provider timeout work spans OpenAI, Runway, xAI, MiniMax, BytePlus, DashScope-compatible, FAL, OpenRouter, Google, and others. And critically, the cron subsystem now keeps SQLite migrations compatible with legacy run-log tables and will retry recurring jobs after transient model rate limits before waiting for the next scheduled slot — a small but impactful fix for operators who use rate-limited local models in cron jobs.
For CI and QA, bounded test artifacts and capped log sizes mean failures actually report cleanly instead of stalling. If you have been debugging test flakes in a fork, this release likely helps.
🔒 Security Tip of the Day
Bound Your Timeouts Before They Bound You
One of the quietest but most important security themes in this release is the comprehensive timeout bounding across every provider, channel, and polling path. It is worth understanding why unbounded timeouts are not just a reliability problem — they are a security problem.
When a request or polling loop can hang indefinitely, it creates several exploitable conditions:
- Resource exhaustion: An attacker who can trigger an agent action that calls a slow external service can hold your runtime's attention indefinitely, starving other operations.
- OAuth/token lifetime exploitation: Device-code flows and OAuth handshakes with indefinite timeouts can be used to keep authorization windows open longer than intended, making replay attacks more viable.
- Stale session persistence: Sessions that never properly time out can accumulate stale auth tokens and orphaned tool state — the exact conditions that make privilege escalation easier.
- Silent failure amplification: When the system cannot distinguish "provider is slow" from "something is wrong," security signals get buried in noise.
Operator checklist: After upgrading to this release, verify your gateway logs are no longer showing hung provider calls. If you see requests that never returned before this upgrade, that is a signal that something in your config or network path was being silently exploited or failing. Look for patterns, not just isolated incidents.
Bottom line: Unbounded timeouts are a vulnerability surface, not just a performance issue. OpenClaw is making the right call by auditing and bounding them systematically across the entire runtime.
⭐ Skill of the Day: skill-creator
🔧 skill-creator
What it does: The skill-creator skill helps you build, audit, tidy, validate, and restructure OpenClaw AgentSkills and SKILL.md files. It knows the current skill schema, understands the proposal lifecycle (relevant with today's Skill Workshop launch), and can guide you through creating a well-formed skill from scratch or refactoring an existing one.
Why it's relevant today: With the Skill Workshop now live, any operator thinking about contributing skills to ClawHub needs to understand the proposal format, frontmatter requirements, and scanner-compatibility constraints. The skill-creator skill handles all of that — including the new PROPOSAL.md draft format for pending proposals.
Safety notes: This is a knowledge-based skill — it guides you through authoring, it does not execute arbitrary code or make network calls on your behalf. The skill is maintained by the OpenClaw team as a bundled skill (available at ~/.openclaw/plugin-skills/ or via ClawHub), making its provenance and maintenance status clear. We recommend verifying the current hash on ClawHub before installing from any third-party source.
Install: npx clawhub@latest install skill-creator
Best use case: Pair it with the Skill Workshop's PROPOSAL.md format after today's release. If you have been sitting on a skill idea but weren't sure how to structure it for community submission, today's release and this skill together remove both excuses.
👥 Community Highlights
Sam Altman Recommends Signing Into OpenClaw With a ChatGPT Account
In a story that had the AI community buzzing this week, OpenAI CEO Sam Altman publicly endorsed using a ChatGPT account to authenticate with OpenClaw — and Tom's Guide sent a writer to actually do it and document the experience. The verdict was predictably positive: the setup worked cleanly, and the resulting agent behavior (cron-scheduled morning briefings to Discord, scheduled task management, real-time information access) came across as polished and genuinely useful for a mainstream audience.
What makes this notable is who said it. Altman is not a random tech influencer. He runs OpenAI, which has its own agentic ambitions in the form of Operator and ChatGPT tasks. The fact that he is publicly directing users toward OpenClaw is either a genuine product endorsement, a tactical acknowledgment that OpenClaw fills a gap OpenAI has not yet closed, or both. Probably both.
The Tom's Guide article specifically called out cron-scheduled Discord briefings as a "standout feature" — the exact kind of workflow SEN-X readers have been running for months. If mainstream tech press is now covering OpenClaw's cron system as a headline capability, the project has fully crossed from developer niche to mainstream productivity story.
@shakkernerd and @stevenepalmer Ship Meaningful Community Contributions
Two community contributors landed notable features in this release. @shakkernerd drove the entire Skill Workshop proposal lifecycle — four separate contributions covering the proposal format, revision flow, CLI/Gateway review actions, rollback metadata, and the skill_research agent tool. That is a substantial amount of coordinated design and implementation work, and it landed cleanly.
@stevenepalmer contributed the Dreaming-tab agent selector in the Control UI. Smaller in scope but meaningfully useful for anyone running named multi-agent configurations.
Both contributions reflect what a healthy open-source project looks like: community members adding governance and observability features, not just novelty. The OpenClaw project has cultivated a contributor base that cares about the right things.
ClawHub Crosses 52.7K Tools and 12M Downloads
ClawHub is reporting 52.7K tools, 180K users, and 12M downloads. The average rating sits at 4.8. Those are meaningful numbers for an ecosystem that was essentially nonexistent at the start of 2025. The growth trajectory also explains why the Skill Workshop matters: when you have 52.7K tools, informal community review no longer scales. You need proposal lifecycles, scanner integration, and rollback infrastructure. Today's release is catching up to the scale that already exists.
🌐 Ecosystem News
Google Gemini Spark Goes Live: The Cloud Agent War Is Now Open
Google I/O 2026 was not short on announcements, but the one that matters most for OpenClaw operators is Gemini Spark — Google's direct entry into the personal AI agent market. At Google's annual developer conference, CEO Sundar Pichai announced that Spark would be available to Google AI Ultra subscribers, running on the new Gemini 3.5 Flash model.
Mashable's coverage framed it as "Gemini Spark vs OpenClaw" and laid out the genuine competitive tension clearly. Gemini Spark is cloud-based, always-on without additional hardware, and has native access to Gmail, Google Docs, Drive, and Google Calendar if you are already in the Google ecosystem. It does not require a Mac Mini or a complex installation process. That is a real advantage for mainstream users who find OpenClaw's setup intimidating.
But the comparison also surfaces OpenClaw's differentiators: local-first data ownership, full control over which models you use, a configurable multi-channel delivery system (Discord, WhatsApp, iMessage, Telegram), and the ClawHub skills ecosystem that now spans 52.7K tools. Gemini Spark will ship with Google's curated capability set. OpenClaw ships with whatever the community has built.
"OpenClaw started a mini-revolution in the AI world by showing what was possible with AI agents." — Mashable
The competitive framing is useful, but the more important signal is that a well-resourced cloud competitor with 900 million Gemini monthly active users is now in the personal agent market. That is validation that the market OpenClaw pioneered is real. It also means the next phase of OpenClaw's evolution will need to make the local-first, multi-channel, customizable case more legible to users who are now being offered a simpler cloud alternative.
Google entering the personal agent market with a polished cloud product is good for OpenClaw more than it is a threat. It legitimizes the entire category. The users who discover Gemini Spark and want more control, more customization, or more privacy will find OpenClaw waiting for them. The ecosystem that matters is the one that serves people who know what they want from an AI agent — and that audience is growing fast.
Orca Builds Execution Infrastructure on Top of OpenClaw
A new project called Orca announced this week that it is building its AI agent execution infrastructure on top of OpenClaw. The platform combines autonomous AI agents, Nodepay-powered sentiment intelligence, and OpenClaw automation infrastructure to create "a full-stack intelligent" market participation layer. According to the announcement, it is targeting a market inefficiency at the infrastructure level using OpenClaw as its execution substrate.
This kind of third-party build-on story is important to track. When sophisticated infrastructure teams choose OpenClaw as their execution layer over building their own, it signals two things: OpenClaw's primitives are mature enough to build serious products on top of, and the project's open architecture (rather than a locked-down cloud API) is genuinely useful for production use cases beyond personal assistance.
npm Package Reaches v2026.5.27 with 126 Dependent Projects
The openclaw npm package hit version 2026.5.27 this week, and the registry now lists 126 other projects depending on it directly. That is a proxy metric worth watching: direct npm dependents are typically build tools, plugins, integration libraries, and automation systems that need the OpenClaw runtime as a component rather than a standalone product. 126 is not a massive number in absolute terms, but it is a meaningful proxy for the depth of the ecosystem that is building around the core package.
The beta.1 pre-release this morning (v2026.5.28-beta.1) is already on npm at https://www.npmjs.com/package/openclaw/v/2026.5.28-beta.1 for operators who want to validate it before it graduates to stable.
Agentic Enterprise Infrastructure Keeps Professionalizing
The broader enterprise agent market this week continued its convergence toward governed, observable, interoperable infrastructure. Camunda's ProcessOS announcement at CamundaCon (available in closed beta from May 20) frames agentic workflows as the next layer of business process management — AI agents as first-tier consumers of enterprise process APIs, not just chat surfaces.
Okta's "AI Agents at Work 2026" report takes the security angle further, with specific guidance on identifying, governing, and securing your "agentic workforce." The framing — an AI agent as a workforce member that needs identity governance — is exactly the direction the enterprise security community is moving. OpenClaw operators running agents with meaningful tool access should read this framing carefully: the identity and access management lens is coming to AI agents, whether the tools support it explicitly or not.
May 31, 2026 is a day where OpenClaw ships significant governance infrastructure (Skill Workshop, Workboard, official plugins), a major cloud competitor goes live (Gemini Spark), and the enterprise world publishes serious frameworks for governing the exact kind of agents OpenClaw powers. All three things happening simultaneously is not a coincidence — it is the moment where the AI agent ecosystem stops being "early" and becomes something you have to be deliberate about. Whether you are building on OpenClaw or evaluating alternatives, the governance question is now unavoidable.
Need help with OpenClaw deployment?
SEN-X provides enterprise OpenClaw consulting — architecture, security hardening, custom skill development, and ongoing support.
Contact SEN-X →