🔎 Evidence browser

Browse the skill radar

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
✨ Quick picks
🏷 Categories · coding-agents-and-ides

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

Results

Showing 24 of 1200 skills in the browsable catalog view · reviewed: no · category: coding-agents-and-ides · sort: score
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

zeroapi

dorukardahan · vsource-scanned
47
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (private key, token, oauth, telegram, whatsapp), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

agent-media

nevo-david · vsource-scanned
46
overall

AI UGC video production from the terminal using the `agent-media` CLI.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

agentshield-audit

bartelmost · vsource-scanned
46
overall

Trust Infrastructure for AI Agents - Like SSL/TLS for agent-to-agent communication. 77 security tests, cryptographic certificates, and Trust Handshake Protocol for establishing secure channels between agents.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: eval(, curl |, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

apipick-ip-geolocation

javainthinking · vsource-scanned
46
overall

Look up geographic location and network information for any IPv4 or IPv6 address using the apipick IP Geolocation API. Returns country, continent, city, latitude/longitude, timezone, currency, ISP, and ASN. Use when the user wants to geolocate an IP address, find the country or city for an IP, identify the ISP or ASN of an IP, look up timezone or currency for an IP, or check their own public IP location. Omit the IP parameter to look up the caller's own IP. Requires an apipick API key (x-api-key). Get a free key at https://www.apipick.com.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

atlassian-cli

peetzweg · vsource-scanned
46
overall

Reference guide for the Atlassian CLI (acli) - a command-line tool for interacting with Jira Cloud and Atlassian organization administration. Use this skill when the user wants to perform Jira operations (create/edit/search/transition work items, manage projects, boards, sprints, filters, dashboards), administer Atlassian organizations (manage users, authentication), or automate Atlassian workflows from the terminal. Covers all acli commands including: jira workitem (create, edit, search, assign, transition, comment, clone, link, archive), jira project (create, list, update, archive), jira board/sprint, jira filter/dashboard, admin user management, and rovodev (Rovo Dev AI agent). Requires an authenticated acli binary already installed on the system.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

bstorms

pouria3 · vsource-scanned
46
overall

Use when your agent is stuck on a complex task and needs a proven solution from agents that already shipped it. Get operational playbooks for multi-agent coordination, memory architecture, deployment pipelines, tool integration, and debugging. Share what you know and earn USDC on Base.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

budget-variance-analyzer

unknown · vcatalog
46
overall

Analyze budget vs actual.

Use Cautionconfidence: limited evidencecatalog-only
+ 1 more
privileged capability
Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.
Decision cue: Thin evidence slice — do not treat this card like a verified green light.

composio-connect

samotheos · vsource-scanned
46
overall

Connect 850+ apps (Gmail, Slack, GitHub, Calendar, Notion, Jira, and more) to OpenClaw via Composio and mcporter. Use when the user asks to send emails, create issues, post messages, manage calendars, search documents, or interact with any third-party SaaS app. One skill, 11,000+ tools, managed OAuth.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (oauth, gmail, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

crabukit

tnbradley · vsource-scanned
46
overall

Security scanner for OpenClaw skills with Clawdex integration. Analyzes SKILL.md and scripts for dangerous permissions, hardcoded secrets, shell injection vulnerabilities, and malicious code patterns. Automatically uses Clawdex database if installed for known-malicious skill detection. Use when (1) installing a skill from an untrusted source, (2) developing a skill before publishing, (3) auditing installed skills, or (4) running CI/CD security checks.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: eval(, curl |, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

demo-agents-sdk

jameslawton · vsource-scanned
46
overall

Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity + reputation, x402 micropayments. Single CLI entry point, AES-256-GCM encrypted storage.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

hive-agent

kerlos · vsource-scanned
46
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (trading), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

incidentio

jensastrup · vsource-scanned
46
overall

Manage incidents via the incident.io REST API. Create, view, update, escalate, and resolve incidents. Check severities, statuses, and post incident updates. Requires INCIDENTIO_API_KEY environment variable.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

intercom-lightning

tracsystems · vsource-scanned
46
overall

IntercomSwap (OpenClaw-hardened): operator-run, manual-only P2P RFQ swaps that negotiate over Intercom sidechannels and settle BTC (Lightning) <-> USDT (Solana) via an escrow program. High-risk financial operations; require explicit human approval for any fund-moving action.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

mansion

sarthib7 · vsource-scanned
46
overall

The Zoro agent system is architected as a hierarchical mansion structure, where **Zorro** serves as the master.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

platform-api-connector

brandonwadepackard-cell · vsource-scanned
46
overall

Connect to social media and content platform APIs by navigating developer portals, creating apps, obtaining OAuth tokens, and storing credentials. Covers Facebook Graph API, Instagram Business API, YouTube Data API, Twitter/X API v2, and TikTok Content Posting API. Use when setting up API access for any social platform, refreshing expired OAuth tokens, or debugging authentication flows.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

qrcoin

ktaesthetix · vsource-scanned
46
overall

Interact with QR Coin auctions on Base. Use when the user wants to participate in qrcoin.fun QR code auctions — check auction status, view current bids, create new bids, or contribute to existing bids. QR Coin lets you bid to display URLs on QR codes; the highest bidder's URL gets encoded.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

review-orchestrator

leegitw · vsource-scanned
46
overall

Get multiple perspectives on your work — coordinate reviews across cognitive modes

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

robonet-workbench

nickemmons · vsource-scanned
46
overall

Use Robonet's MCP server to build, backtest, optimize, and deploy trading strategies. Provides 24 specialized tools for crypto and prediction market trading: (1) Data tools for browsing strategies, symbols, indicators, Allora topics, and backtest results, (2) AI tools for generating strategy ideas and code, optimizing parameters, and enhancing with ML predictions, (3) Backtesting tools for testing strategy performance on historical data, (4) Prediction market tools for Polymarket trading strategies, (5) Deployment tools for live trading on Hyperliquid, (6) Account tools for credit management. Use when: building trading strategies, backtesting strategies, deploying trading bots, working with Hyperliquid or Polymarket, or enhancing strategies with Allora Network ML predictions.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

social-media-planner

mkpareek0315 · vsource-scanned
46
overall

When user asks to plan social media posts, create content calendar, write captions, generate hashtags, schedule posts, plan content strategy, write tweets, create Instagram captions, plan LinkedIn posts, batch content creation, track post ideas, or any social media content task. 18-feature AI social media content planner with caption writer, hashtag generator, content calendar, post templates, and analytics tracking. All data stays local — NO external API calls, NO network requests, NO data sent to any server. Does NOT post to social media — generates text content for user to copy and post manually.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

token-efficiency-guide

globalcaos · vsource-scanned
46
overall

Go from weekly limit on Tuesday to weekly limit on Sunday. 10 steps, one afternoon.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, whatsapp), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

tubelab-api

antoniojps · vsource-scanned
46
overall

YouTube analytics and research API.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

tyt

hunterdrop22 · vsource-scanned
46
overall

The Teneo SDK (`@teneo-protocol/sdk`) enables connection to AI agents on the Teneo Protocol platform. It provides:

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

upinvoice

upinvoice · vsource-scanned
46
overall

This skill allows any OpenClaw-powered agent to extract structured JSON data from invoice images or PDFs using the [UpInvoice.eu](https://upinvoice.eu) AI service. It is designed to be the fastest and most cost-effective way to automate invoice processing for ERP systems.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

yoder-skill-auditor

yoder-bawt · vsource-scanned
46
overall

The definitive security scanner for OpenClaw skills. 18 security checks including prompt injection detection, download-and-execute, privilege escalation, credential harvesting, supply chain attacks, crypto drains, and more. 5-dimension trust scoring with trend tracking.

High Riskfollow-on functionality checks passed · 9/9confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what passed2026-03-14 21:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 157 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2943 msbaseline-v3 8/8
RatioDaemon on this skillYoder Skill Auditor sits in the the definitive security scanner for OpenClaw skills lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, curl |, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.