🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
✨ Quick picks
🏷 Categories · awesome-index

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5367 skills in the browsable catalog view · reviewed: no · category: awesome-index · sort: score
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

sequence-cli

jameslawton · vsource-scanned
45
overall

Manage Sequence smart wallets, projects, API keys, ERC20 transfers, and query blockchain data using the Sequence Builder CLI. Use when user asks about creating wallets, sending tokens, checking balances, managing Sequence projects, or interacting with EVM blockchains.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

setup-automatik

alltomatos · vsource-scanned
45
overall

Facilitate the installation and management of VPS solutions using the Setup Automatik engine (powered by Orion Design). Use when the user wants to install, configure, or manage tools like Traefik, Portainer, Chatwoot, N8N, and other open-source applications on a Linux VPS.

High Riskfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 21:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 117 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2361 msbaseline-v3 8/8
RatioDaemon on this skillSetup Automatik looks aimed at setup automatik. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

simplified-social-media

jacksimplified · vsource-scanned
45
overall

Manage your entire social media from AI — post, schedule, and analyze across Facebook, Instagram, TikTok, YouTube, LinkedIn, Pinterest, Threads, Bluesky and Google Business

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

skillguard-scanner

msgnoki · vsource-scanned
45
overall

Security scanner for OpenClaw/ClawHub skills. Detects malware, reverse shells, credential theft, prompt injection, memory poisoning, typosquatting, and suspicious prerequisites before installation. Use when installing new skills, auditing existing skills, checking a skill name for typosquatting, or scanning ClawHub skills for security risks.

High Riskfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 21:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2583 msbaseline-v3 8/8
RatioDaemon muttered: skillguard-scanner looked ordinary in the good, boring way.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

skulk-skill-scanner

adainthelab · vsource-scanned
45
overall

Scan OpenClaw skill folders for security red flags before installing or publishing. Detects data exfiltration, credential theft, prompt injection, destructive commands, obfuscation, privilege escalation, and supply chain risks. Use when: evaluating a skill from ClawHub before install, auditing your own skills before publishing, or reviewing any SKILL.md for safety. NOT for: general code review or vulnerability scanning of non-skill codebases.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

sovereign-daily-digest

ryudi84 · vsource-scanned
45
overall

You are the **Daily Digest** skill. Your purpose is to compile information from multiple sources into a single, beautifully formatted daily report. You act as a personal intelligence briefing system.

High Riskfollow-on functionality checks failed · 6/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test found2026-03-14 01:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfailure repeated in more than one runpassed, runtime failedoutput 239 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2253 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: The runtime lane gave sovereign-daily-digest a chance to act normal. It declined and made it to runtime and then fell apart on contact.6/7 functionality-v2 checks passed before the stumble. The shell syntax is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Newcomer read: Review first — functionality-v2 already found trouble.

spf-dkim-setup

masasdani · vsource-scanned
45
overall

Manage DNS records via the Cloudflare API. Create, list, update, and delete DNS records (A, AAAA, CNAME, TXT, MX, SPF, DKIM). Use when the agent needs to add or modify DNS records, set up email authentication (SPF/DKIM/DMARC), verify domains, or manage any DNS configuration on Cloudflare-hosted domains. Works great with mailtarget-email for fully autonomous sending domain setup.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

stackunderflow

zanderd18s · vsource-scanned
45
overall

A knowledge-retrieval protocol allowing the agent to access a verified community knowledge base.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

synology-backup

pfrederiksen · vsource-scanned
45
overall

Backup and restore OpenClaw workspace, configs, and agent data to a Synology NAS via SMB. Use when: backing up workspace files, restoring from a snapshot, checking backup status/health, or setting up automated backups. Supports Tailscale for secure remote VPS-to-NAS connectivity.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-15 05:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1966 msbaseline-v3 8/8
RatioDaemon on this skillSynology Backup is built for synology backup. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

talkspresso

baron-talkspresso · vsource-scanned
45
overall

Manage a Talkspresso business (services, appointments, products, clients, earnings, calendar) using the Talkspresso REST API. Use when the user wants to check bookings, create services, manage digital products, view earnings, update their profile, schedule sessions, or do anything related to their Talkspresso account. Requires TALKSPRESSO_API_KEY environment variable.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

temporal-cortex-datetime

billylui · vsource-scanned
45
overall

|-

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

theswarm

marketingax · vsource-scanned
45
overall

Earn passive income as an AI agent. Join The Swarm - a crypto-powered social network where agents earn XP and money helping each other grow YouTube channels. No Phantom extension needed - full CLI auth for autonomous agents. Solana wallet, earn crypto, passive revenue, agent economy.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

tiktok-crawling

romneyda · vsource-scanned
45
overall

Use for TikTok crawling, content retrieval, and analysis

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

to-do

devlumuz · vsource-scanned
45
overall

Give your AI the power to act in the future. Schedule delayed prompts and one-off reminders that automatically wake the agent up at an exact moment to execute workflows, check systems, or send notifications.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

token-management

nonlinear · vsource-scanned
45
overall

Centralized API token management workflow. Store tokens in .env with expiration dates, test permissions via script battery, document capabilities in connections/, set calendar renewal reminders. Prevents re-asking for credentials, ensures token security, tracks expiration.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

trust-memory

trustmemory-admin · vsource-scanned
45
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (oauth, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

ultra-agent-stinct

grimmjoww · vsource-scanned
45
overall

Internal debugging and coding skill. Activates automatically when YOU hit a code error, build failure, stack trace, or unexpected behavior during any task. This is your instinct for fixing things — not a user-triggered skill. If a command fails, a script throws an error, or something breaks while you're working, use this to debug and fix it yourself.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

unloopa-api

echris6 · vsource-scanned
45
overall

Make your agent sell websites to local businesses on autopilot. Finds leads from Google Maps, builds a custom AI website for each one, sends outreach emails, and can even call them. Use when the user wants to find leads, generate websites, send emails, or make voice calls.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

video-sourcing

samuelz12 · vsource-scanned
45
overall

Run the Video Sourcing Agent with deterministic, concise chat UX for /video_sourcing using a pinned self-bootstrap runtime.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

web3-target-team-research

shwchlorine · vsource-scanned
45
overall

Find crypto/web3 teams with $10M+ funding and verified Telegram contacts. Use when hunting for crypto leads, building contact lists, researching funded startups, or prospecting web3 companies. Spawns parallel subagent hunters to search VC portfolios and verify TG handles.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token, telegram), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

whistle-rpc

dylanport · vsource-scanned
45
overall

slug: whistle-rpc

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

windsensei

jumptrnr · vsource-scanned
45
overall

Check wind and weather conditions for wind sports (kitesurfing, wingfoiling, surfing). Get forecasts, find spots nearby, view session history, and request new spots.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

xobni

ghoshsanjoy78 · vsource-scanned
45
overall

Email infrastructure for AI agents via Xobni.ai. Provides real email addresses (@xobni.ai) with REST API and MCP server access. Use when an AI agent needs to send/receive email, search inbox, manage attachments, or set up webhooks for email notifications.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

zerodha-kite

jatinbansal1998 · vsource-scanned
45
overall

Route natural-language trading/account queries to the correct `zerodha` CLI command with exact flags, validation constraints, and synonym mapping. Use when a user asks to view prices, place/modify/cancel orders, manage auth/profile/config, work with holdings/positions/margins/GTT/MF flows, or asks "which zerodha command should I run?

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (trading, token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.