D
DriftLoom.ai
Trust index first • editorial second
🧪 runtime dashboard live
☰ Menu
🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180
✨ Quick picks
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
🏷 Categories · coding-agents-and-ides
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 1200 skills in the browsable catalog view · reviewed: no · category: coding-agents-and-ides · sort: score
page evidence snapshotruntime-passed: 3runtime-failed: 0source-scanned: 24fresh <24h: 1manual review: 0
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

cyber-security-engineer

fletcherfrimpong · vsource-scanned
61
overall

Security engineering workflow for OpenClaw privilege governance and hardening. Use for least-privilege execution, approval-first privileged actions, idle timeout controls, port + egress monitoring, and ISO 27001/NIST-aligned compliance reporting with mitigations.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

dependency-auditor

alirezarezvani · vsource-scanned
61
overall

Dependency Auditor

Use Cautionfollow-on functionality checks passed · 10/10confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what passed2026-03-14 00:22 UTC
functionality-v2evidence depth: includes fixture-backed checkstested recently: within 7 dayspassedoutput 9.9 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 4244 msbaseline-v3 8/8
RatioDaemon on this skillDependency Auditor is built for dependency auditing. Follow-on functionality checks currently pass without failed checks, the trust label is Use Caution, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

describe-design

ziad-hsn · vsource-scanned
61
overall

>

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

diddy-party

sal-jim · vsource-scanned
61
overall

Persona skill that rebrands the assistant as "Diddy" for a theatrical hip-hop party-host vibe, with themed sub-agent aliases, slang-forward voice, and OpenClaw-native workflow language.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

email-security

ivaavimusic · vsource-scanned
61
overall

Protect AI agents from email-based attacks including prompt injection, sender spoofing, malicious attachments, and social engineering. Use when processing emails, reading email content, executing email-based commands, or any interaction with email data. Provides sender verification, content sanitization, and threat detection for Gmail, AgentMail, Proton Mail, and any IMAP/SMTP email system.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

finishing-a-development-branch

zlc000190 · vsource-scanned
61
overall

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

fis-architecture

muselinn · vsource-scanned
61
overall

Orchestrate multi-agent workflows with JSON tickets and A2A coordination. Use when delegating tasks between CyberMao (Main) and Worker agents (Engineer/Researcher/Writer).

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

fletcher-cyber-security-engineer

fletcherfrimpong · vsource-scanned
61
overall

Security engineering workflow for OpenClaw privilege governance and hardening. Use for least-privilege execution, approval-first privileged actions, idle timeout controls, port + egress monitoring, and ISO 27001/NIST-aligned compliance reporting with mitigations.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

forever-moments

luksoagent · vsource-scanned
61
overall

|

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

gatewaystack-governance

davidcrowe · vsource-scanned
61
overall

Deny-by-default governance for every tool call — identity, scope, rate limiting, injection detection, audit logging, plus opt-in output DLP, escalation, and behavioral monitoring. Hooks into OpenClaw at the process level so the agent can't bypass it.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

hybrid-md

mkassab30-ux · vsource-scanned
61
overall

\# Agent Identity: The Hybrid MD (Dr.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (trading), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

identity-resolver

bowen31337 · vsource-scanned
61
overall

**Canonical user identity resolution across messaging channels**

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram, whatsapp), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

imessage-voice-reply

bolander72 · vsource-scanned
61
overall

Send voice message replies in iMessage using local Kokoro-ONNX TTS. Generates native iMessage voice bubbles (CAF/Opus) that play inline with waveform — not file attachments. Use when receiving a voice message in iMessage and wanting to reply with voice, enabling voice-to-voice iMessage conversations, or sending audio responses. Zero cost — all TTS runs locally. Requires BlueBubbles channel configured in OpenClaw.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

instagram-content-studio

uyeong · vsource-scanned
61
overall

Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests any Instagram-related task.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

intermittent-fasting-skill

yoavfael · vsource-scanned
61
overall

author: yoavfael

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

ipeaky

christiancattaneo · vsource-scanned
61
overall

Secure API key management for OpenClaw. Store, list, test, and delete API keys without exposing them in chat history. Keys are stored directly in openclaw.json via gateway config.patch — fully native integration. Use when a user needs to provide, manage, or test API keys (e.g., OpenAI, ElevenLabs, Anthropic, Brave, or any service). Triggers on phrases like "add API key", "store my key", "manage keys", "test my key", "set up API key", or when a skill requires an API key that isn't configured.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

iyeque-pdf-reader

iyeque · vsource-scanned
61
overall

Extract text, search inside PDFs, and produce summaries.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

jk-archivist-tiktok-packager

jk-archivist · vsource-scanned
61
overall

Generate deterministic 6-slide portrait PNG slideshow assets plus caption text for TikTok-style posting workflows, including reusable templates and a strict validation pipeline.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

larry

olliewazza · vsource-scanned
61
overall

Automate TikTok slideshow marketing for any app or product. Researches competitors, generates AI images, adds text overlays, posts via Postiz, tracks analytics, and iterates on what works. Use when setting up TikTok marketing automation, creating slideshow posts, analyzing post performance, optimizing app marketing funnels, or when a user mentions TikTok growth, slideshow ads, or social media marketing for their app. Covers competitor research (browser-based), image generation, text overlays, TikTok posting (Postiz API), cross-posting to Instagram/YouTube/Threads, analytics tracking, hook testing, CTA optimization, conversion tracking with RevenueCat, and a full feedback loop that adjusts hooks and CTAs based on views vs conversions.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

learning-loop

yoder-bawt · vsource-scanned
61
overall

Structured self-improvement system for AI agents with confidence decay, cross-agent sharing, and anomaly detection. Use when: (1) After debugging sessions to capture lessons learned, (2) When receiving feedback or corrections from users, (3) Before risky actions to check relevant rules, (4) Weekly to review metrics and promote proven patterns to enforced rules, (5) Setting up persistent memory that survives session compactions.

Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what passed2026-03-14 16:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 121 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2291 msbaseline-v3 8/8
RatioDaemon on this skillLearning Loop is built for learning loop. Follow-on functionality checks currently pass without failed checks, the trust label is Use Caution, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

life-control

rachitsharma123 · vsource-scanned
61
overall

Orchestrate the Life Control CLI skill for OpenClaw agent fleets: initialize the Life Control database, register agent personas, wire Telegram bots, and run daily routines (Morning Alignment, Body Protocol, Financial Pulse, Social Radar, Work Priming, Shutdown). Use when a user asks to create or run a Life Control system, OpenClaw skill integration, or agent persona automation for personal life tracking.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, telegram), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

lily-memory

kevinodell · vsource-scanned
61
overall

Persistent memory plugin for OpenClaw agents. Hybrid SQLite FTS5 keyword + Ollama vector semantic search with auto-capture, auto-recall, stuck-detection, and memory consolidation.

High Riskfollow-on functionality checks passed · 9/9confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what passed2026-03-16 11:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 176 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3201 msbaseline-v3 8/8
RatioDaemon muttered: lily-memory behaved itself under runtime pressure.9/9 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

lite-sqlite

omprasad122007-rgb · vsource-scanned
61
overall

Fast lightweight local SQLite database for OpenClaw agents with minimal RAM and storage usage. Use when creating or managing SQLite databases for storing agent data efficiently. Ideal for local data persistence quick agent data storage low-memory databases small-scale applications and agent memo and caching storage.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

markdown-editor-with-chat

musketyr · vsource-scanned
61
overall

Lightweight markdown editor with optional OpenClaw gateway chat. Filesystem-based, no database required.

Trustedconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
« First← Prev115161750Page 16 / 50Next →Last »