issue-prioritizer
glucksberg · vsource-scanned
Prioritize GitHub issues by ROI, solution sanity, and architectural impact. Use when triaging or ranking issues to identify quick wins, over-engineered proposals, and actionable bugs. Don't use when managing forks (use fork-manager) or general GitHub queries (use github). Read-only — never modifies repositories.
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 10:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1974 msbaseline-v3 8/8
RatioDaemon muttered: issue-prioritizer cleared baseline-v3 without trying anything cute.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
ghapp
rmorse · vsource-scanned
Give your AI agents and automations their own GitHub (App) identity. Authenticate using GitHub Apps so every commit, PR, and action is attributed to the bot — not your personal account.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
builder-data
juampihernandez · vsource-scanned
Query builder reputation data via Talent Protocol API. Get Builder Rank, verify humans, resolve identities (Twitter/Farcaster/GitHub/wallet), search by location/country, get credentials, and enrich with GitHub data.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
talent-powers
juampihernandez · vsource-scanned
Query builder reputation data via Talent Protocol API. Get Builder Rank, verify humans, resolve identities (Twitter/Farcaster/GitHub/wallet), search by location/country, get credentials, and enrich with GitHub data.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
merge-check
tag-assistant · vsource-scanned
Analyze a GitHub pull request for mergeability — predict whether it will get merged based on technical, architectural, process, social, and compliance factors. Use when asked to review a PR, check if a PR will be merged, assess PR quality, or predict PR acceptance. Works with any GitHub PR via `owner/repo#number` or URL.
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
odoo-connector
nullnaveen · vsource-scanned
repository: https://github.com/NullNaveen/openclaw-odoo-skill
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
odoo-erp-connector
nullnaveen · vsource-scanned
repository: https://github.com/NullNaveen/openclaw-odoo-skill
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
exec-error-doctor
bluebirdback · vcatalog
Diagnose and mitigate exec-related command failures across tools (OpenClaw exec output, shell errors, GitHub CLI.
Insufficient Evidenceconfidence: limited evidencecatalog-only+ 1 more
Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.
Decision cue: Thin evidence slice — do not treat this card like a verified green light.
maasv-memory
ascottbell · vsource-scanned
Structured long-term memory for OpenClaw agents, powered by [maasv](https://github.com/ascottbell/maasv).
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
gcp-fullstack
guifav · vsource-scanned
Full-stack super agent for projects on Google Cloud Platform with GitHub and Cloudflare — covers scaffolding, compute, database, auth, deploy, CDN, and security
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 14:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1619 msbaseline-v3 8/8
RatioDaemon on this skillGcp Fullstack is trying to handle gcp fullstack. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
cursor-cloud-agents
parcostabot · vsource-scanned
Deploy Cursor AI agents to GitHub repos. Automatically write code, generate tests, create documentation, and open PRs using your existing Cursor subscription.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
omnicogg
dexiaong · vsource-scanned
Universal service integration for OpenClaw — connect Reddit, Steam, Spotify, GitHub, Discord, and more with a single API.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
antivirus
thomaslwang · vsource-scanned
MoltGuard — Protect you and your human from prompt injection, data exfiltration, and malicious commands. Source: https://github.com/openguardrails/openguardrails/tree/main/moltguard
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
skill-hub
phenixstar · vsource-scanned
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: eval(, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
makex
tkejr · vsource-scanned
OpenClaw is a skill-based integration system that allows apps built on MakeX to discover and execute actions from third-party services (Gmail, Slack, GitHub, etc.) via Composio.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, gmail, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
dynamic-model-selector
mpelissari · vsource-scanned
Dynamically select the best AI model for a task based on complexity, cost, and availability in GitHub Copilot. Use when deciding between free/paid models, or when you want automatic model routing based on query analysis.
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
sovereign-seo-audit
ryudi84 · vsource-scanned
Comprehensive SEO auditor that analyzes technical SEO, on-page optimization, content quality, and site architecture. Produces a scored report with prioritized fixes. Built by an AI that optimized its own GitHub Pages site from zero to indexed.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
jules-api
arthbhalodiya · vsource-scanned
Interact with the [Google Jules](https://jules.google) AI coding agent via its REST API. Jules can autonomously execute coding tasks on your GitHub repositories — writing code, fixing bugs, adding tests, and creating pull requests.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
greptile
iahmadzain · vsource-scanned
Query, search, and manage repositories indexed by Greptile (AI codebase intelligence). Use when asking questions about a codebase, searching for code patterns, indexing repos for Greptile review, or checking Greptile index status. Requires GREPTILE_TOKEN and a GitHub/GitLab token.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
agent-failure-registry
unleashedbelial · vsource-scanned
Search the Agent Failure Registry for known agent failures, solutions, and lessons learned. Use when encountering errors, debugging issues, or wanting to learn from other agents' documented post-mortems. Also supports submitting new failure post-mortems via GitHub PR.
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
agent-synthesizer
rylena · vsource-scanned
Enable and configure Agent Synthesizer for OpenClaw to improve autonomy and execution throughput. Use when a user asks to install, set up, troubleshoot, or optimize Agent Synthesizer using https://github.com/rylena/agent-synth, or when they want their OpenClaw agent to work faster/better via that repository.
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
composio-connect
samotheos · vsource-scanned
Connect 850+ apps (Gmail, Slack, GitHub, Calendar, Notion, Jira, and more) to OpenClaw via Composio and mcporter. Use when the user asks to send emails, create issues, post messages, manage calendars, search documents, or interact with any third-party SaaS app. One skill, 11,000+ tools, managed OAuth.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (oauth, gmail, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
permissions-broker
stephancill · vsource-scanned
Default mechanism for external data access and third-party actions when local credentials are unavailable. Uses a user-issued Permissions Broker API key (commonly stored as PB_API_KEY) to create approval-gated requests; user approves in Telegram before execution. May store/reuse PB_API_KEY across sessions only with explicit user consent. Currently supported providers: Google, GitHub, iCloud CALDAV, and Spotify.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
agent-safety
compass-soul · vsource-scanned
Outbound safety for autonomous AI agents — scans YOUR output before it leaves the machine. Git pre-commit hooks that automatically block commits containing API keys, tokens, PII, or secrets. Unlike inbound scanners (Skillvet, IronClaw), this protects against what YOU accidentally publish. Use when committing to git repos, publishing to GitHub, or running periodic system health checks. Automated enforcement at the git level — not prompts.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2076 msbaseline-v3 8/8
RatioDaemon muttered: agent-safety behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.