🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

Security GitHub Weather Trusted with current evidence Higher-confidence picks Trusted + tested + source-scanned Review before installing Runtime-tested Handled fake credentials cleanly Needs real credentials / access Could not fully test yet Fresh runtime evidence Older runtime evidence Hall of Shame Stronger evidence imports Needs review Clear filters

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

✨ Quick picks

Security GitHub Weather Trusted with current evidence Higher-confidence picks Trusted + tested + source-scanned Review before installing Runtime-tested Handled fake credentials cleanly Needs real credentials / access Could not fully test yet Fresh runtime evidence Older runtime evidence Hall of Shame Stronger evidence imports Needs review Clear filters

🏷 Categories · awesome-index

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5367 skills in the browsable catalog view · reviewed: no · category: awesome-index · sort: score

page evidence snapshotruntime-passed: 3 runtime-failed: 0 source-scanned: 23 fresh <24h: 2 manual review: 0

This snapshot is for the current page of results, not the whole filtered universe.

Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

bitrefill-website

marcopesani · vsource-scanned

Browse and explore Bitrefill (bitrefill.com): discover gift cards, mobile top-ups, and eSIMs; search by brand, category, or country; compare products and denominations; understand pricing, availability, and how each product type works. Use when the user mentions Bitrefill, gift cards, phone top-up, or eSIM for travel.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

cabin

kobuta23 · vsource-scanned

Search and book real flights with USDC payments. Gives your AI agent the power to find flights across 500+ airlines and complete bookings paid in USDC on Base. No credit cards, no banks — crypto-native travel commerce.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, token, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

catime

yazelin · vsource-scanned

Fetch and send AI-generated hourly cat images. Every hour a unique cat artwork is born via Google Gemini. Use when user asks for a cat picture, wants to browse the cat gallery, or requests the latest AI-generated cat image to be sent to them.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

chronobets

lordx64 · vsource-scanned

>

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

clankdin

redeemthedream · vsource-scanned

The professional network for AI agents. Build a profile, connect with agents, join organizations, find work. Founding Week - join now to become a permanent founder.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, token, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

clawdbot-sync

udiedrichsen · vsource-scanned

Synchronize memory, preferences, and skills between multiple Clawdbot instances. Supports bi-directional sync via SSH/rsync over Tailscale. Use when asked to sync with another Clawdbot, share memory between instances, or keep multiple agents in sync. Triggers: /sync, 'sync with mac', 'update other clawdbot', 'share this with my other bot'.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence

Runtime receipts + what passed2026-03-15 16:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1976 msbaseline-v3 8/8

RatioDaemon muttered: clawdbot-sync looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

clawdbot-zoho-email

unknown · vcatalog

Complete Zoho Mail integration with OAuth2, REST.

Use Cautionconfidence: limited evidencecatalog-only

Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.

Decision cue: Thin evidence slice — do not treat this card like a verified green light.

clawdefender

nukewire · vsource-scanned

Security scanner and input sanitizer for AI agents. Detects prompt injection, command injection, SSRF, credential exfiltration, and path traversal attacks. Use when (1) installing new skills from ClawHub, (2) processing external input like emails, calendar events, Trello cards, or API responses, (3) validating URLs before fetching, (4) running security audits on your workspace. Protects agents from malicious content in untrusted data sources.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf, password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

codespace-manager

lanbasara · vsource-scanned

Create, manage, and access isolated cloud development environments (codespaces) powered by code-server, Docker, and Cloudflare Tunnel. Pre-installed with Bun, uv, and OpenCode. Use when the user wants to (1) create a new dev environment or codespace, (2) start/stop/restart/delete a codespace, (3) set up an isolated coding workspace, (4) launch a remote VS Code environment, (5) manage development containers, (6) open a browser-based IDE, or mentions codespace, code-server, remote development, dev environment, or cloud IDE.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf, password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

codex-sub-agents

adamsardo · vsource-scanned

Use OpenAI Codex CLI for coding tasks. Triggers: codex, code review, fix CI, refactor code, implement feature, coding agent, gpt-5-codex. Enables Clawdbot to delegate coding work to Codex CLI as a subagent or direct tool.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token, oauth, telegram, whatsapp), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

codex-sub-agents-1

phucanh08 · vsource-scanned

Use OpenAI Codex CLI for coding tasks. Triggers: codex, code review, fix CI, refactor code, implement feature, coding agent, gpt-5-codex. Enables Clawdbot to delegate coding work to Codex CLI as a subagent or direct tool.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token, oauth, telegram, whatsapp), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

curriculum-generator

tarasinghrajput · vsource-scanned

Intelligent educational curriculum generation system with strict step enforcement and human escalation policies

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (telegram), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

debug-methodology

abczsl520 · vsource-scanned

Systematic debugging and problem-solving methodology. Activate when encountering unexpected errors, service failures, regression bugs, deployment issues, or when a fix attempt has failed twice. Also activate when proposing ANY fix to verify it addresses root cause (not a workaround). Prevents patch-chaining, wrong-environment restarts, workaround addiction, and "drunk man" random fixes.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

eachlabs-voice-audio

eftalyurtseven · vsource-scanned

Text-to-speech, speech-to-text, voice conversion, and audio processing using EachLabs AI models. Supports ElevenLabs TTS, Whisper transcription with diarization, and RVC voice conversion. Use when the user needs TTS, transcription, or voice conversion.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

enteriva-ai-social-hub

mehserdar · vsource-scanned

The social network for AI agents.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

forge

ikennaokpala · vsource-scanned

Autonomous quality engineering swarm that forges production-ready code through continuous behavioral verification, exhaustive E2E testing, and self-healing fix loops. Combines DDD+ADR+TDD methodology with BDD/Gherkin specifications, 7 quality gates, defect prediction, chaos testing, and cross-context dependency awareness. Architecture-agnostic — works with monoliths, microservices, modular monoliths, and any bounded-context topology.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, token, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

giraffe-guard

lida408 · vsource-scanned

Scan OpenClaw skill directories for supply chain attacks and malicious code.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: eval(, rm -rf, password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

gmail-tool

junkaixue · vsource-scanned

Send and read emails via Gmail using App Password. CLI utility for automated alerts, notifications, and email monitoring.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

google-workspace-mcp

dru-ca · vsource-scanned

Gmail, Calendar, Drive, Docs, Sheets — NO Google Cloud Console required. Just OAuth sign-in. Zero setup complexity vs traditional Google API integrations.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 23:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1661 msbaseline-v3 8/8

RatioDaemon muttered: google-workspace-mcp cleared the baseline safety checks without trying anything cute.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

healthkit-sync

mneves75 · vsource-scanned

iOS HealthKit data sync CLI commands and patterns. Use when working with healthsync CLI, fetching Apple Health data (steps, heart rate, sleep, workouts), pairing iOS devices over local network, or understanding the iOS Health Sync project architecture including mTLS certificate pinning, Keychain storage, and audit logging.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 23:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1696 msbaseline-v3 8/8

RatioDaemon muttered: healthkit-sync behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

heurist-mesh

wjw12 · vsource-scanned

Real-time crypto token data, DeFi analytics, blockchain data, Twitter/X social intelligence, enhanced web search, crypto project search all in one Skill. For in-depths topics, "Ask Heurist" agent can handle market trends, trading strategies, macro news, and deep research.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

ibt

palxislabs · vsource-scanned

Execution discipline for agents with instinct, verification, trust calibration, approval gates, trust boundaries, trust recovery, discrepancy reasoning, and resilient error handling. Use when you want an agent to act with initiative without becoming reckless, especially for multi-step, trust-sensitive, or high-impact work.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

igpt-email-ask

sammy-spk · vsource-scanned

>

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token, oauth, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

indexy

hsantana · vsource-scanned

Indexy is a cryptocurrency index management platform that enables AI agents to create, manage, and analyze crypto.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

« First ← Prev 1 203 204 205 224Page 204 / 224Next →Last »