🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

Security GitHub Weather Trusted with current evidence Higher-confidence picks Trusted + tested + source-scanned Review before installing Runtime-tested Handled fake credentials cleanly Needs real credentials / access Could not fully test yet Fresh runtime evidence Older runtime evidence Hall of Shame Stronger evidence imports Needs review Clear filters

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

✨ Quick picks

Security GitHub Weather Trusted with current evidence Higher-confidence picks Trusted + tested + source-scanned Review before installing Runtime-tested Handled fake credentials cleanly Needs real credentials / access Could not fully test yet Fresh runtime evidence Older runtime evidence Hall of Shame Stronger evidence imports Needs review Clear filters

🏷 Categories · devops-and-cloud

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 373 skills in the browsable catalog view · evidence: source-scanned · category: devops-and-cloud · sort: score

page evidence snapshotruntime-passed: 1 runtime-failed: 0 source-scanned: 24 fresh <24h: 0 manual review: 0

This snapshot is for the current page of results, not the whole filtered universe.

Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

ralph-quick

dorukardahan · vsource-scanned

Fast security spot-check with 10 iterations (~5-10 min). Use when user says 'quick security check', 'pre-deploy audit', 'ralph quick', 'fast security scan', 'spot check before deploy', or 'daily security check'. Covers secrets, OWASP basics, auth, rate limiting, and containers.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

rollhub-bot-builder

rollhub-dev · vsource-scanned

Build and deploy autonomous gambling bots for Telegram, Discord, and Twitter using Agent Casino API. Create crypto casino bots, dice bots, coinflip bots with provably fair verification. Bot templates for python-telegram-bot, Discord.js, Twitter API. Automated betting, slash commands, inline keyboards, tweet results. Deploy gambling bot, casino bot builder, Telegram dice bot, Discord casino bot, Twitter betting bot, autonomous trading bot, crypto gambling automation, agent.rollhub.com API integration, real-time bet notifications, provably fair bot.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (trading, token, oauth, telegram), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

aws-infra

bmdhodl · vsource-scanned

Chat-based AWS infrastructure assistance using AWS CLI and console context. Use for querying, auditing, and monitoring AWS resources (EC2, S3, IAM, Lambda, ECS/EKS, RDS, CloudWatch, billing, etc.), and for proposing safe changes with explicit confirmation before any write/destructive action.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

capmonster

easonc13 · vsource-scanned

Solve CAPTCHAs (reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, image CAPTCHAs) using CapMonster Cloud API. Use when browser automation encounters CAPTCHA challenges.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

crash-fixer

ryce · vsource-scanned

Autonomous crash analysis and bug fixing. Monitors crash reports from Cloudflare D1, deduplicates, analyzes with Codex 5.3 High, generates fixes, and creates PRs. Usage: /crash-fixer [--hours 24] [--limit 5] [--dry-run]

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

credence

pestafford · vsource-scanned

Check any MCP server or AI tool against the Credence trust registry before installing it. Scores security, provenance, and behavioral risk on a 0-100 scale.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

fennecseo-audit

2winter-dev · vsource-scanned

Uses Fennec SEO Auditor results to audit a URL. Invoke when user wants a quick on‑page/technical SEO health check or to verify favicon/meta/schema and GEO readiness.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

homeassistant-cli

joneschi · vsource-scanned

Advanced Home Assistant control using the official hass-cli tool. Features auto-completion, event monitoring, history queries, and rich output formatting. Alternative to the curl-based homeassistant skill - choose this if you want a more interactive CLI experience with better discovery and formatting.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

lattice

cnf6682 · vsource-scanned

>

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

local-voice

trondw · vsource-scanned

Local text-to-speech (TTS) and speech-to-text (STT) using FluidAudio on Apple Silicon. Sub-second voice synthesis and transcription running entirely on-device via the Apple Neural Engine. Use when setting up local voice capabilities, voice assistant integration, or replacing cloud TTS/STT services.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

mrc-monitor

wysh3 · vsource-scanned

Real-time token monitoring for MRC canteen order system. Monitors Firebase Firestore for token status and notifies when orders are ready. Use when user sends commands like "mrc 73", "token 97", or "monitor 42" to monitor one or multiple canteen tokens. Handles multiple tokens simultaneously, sends independent notifications per token, and auto-exits when all tokens are ready.

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token, telegram, whatsapp), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

nemo

mootbing · vsource-scanned

Search engine for MCP tools and agent skills.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

news-cog

nitishgargiitd · vsource-scanned

Frontier search models with multi-angle research on every query. CellCog combines deep reasoning with SOTA search to produce accurate, comprehensive news briefs, reports, and digests — delivered ready for your agent to consume without flooding its context window. AI news summary, daily briefing, news digest, current events, trend monitoring, competitive intelligence, market updates.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

newsnow

sorrycc · vsource-scanned

|

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

online-shopping

filipmartinsson · vsource-scanned

Browse and buy products from online stores, including Cloudflare-protected sites. Use when the user asks to find, compare, or order products online. Handles product search, price comparison, adding to cart, filling checkout forms, and navigating to payment. Uses a stealth browser (Patchright) to bypass bot detection.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: sudo .

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

patrick

mcsh · vsource-scanned

Access Patrick's expertise library for executive decision infrastructure. List, fetch, and manage structured expertise with context variables. Use for executive briefings, decision framing, and strategic analysis.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

reef-negotiation

staybased · vsource-scanned

Negotiate rates, scope, and terms using Chris Voss's FBI-proven frameworks adapted for freelance and consulting deals.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

save-to-obsidian

chunhualiao · vsource-scanned

Saves markdown content to remote Obsidian vault via SSH

Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence

Runtime receipts + what passed2026-03-14 07:30 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 419 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2253 msbaseline-v3 8/8

RatioDaemon muttered: save-to-obsidian behaved itself under runtime pressure.7/7 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

trilium

mtbf999 · vsource-scanned

Work with Trilium Notes (notebook app) and automate via Trilium Notes ETAPI. This skill allows you to read, search, and create notes in your Trilium database. Use to manage notebook content or search for information within Trilium. To get started: (1) In Trilium, go to Options -> ETAPI and create a new ETAPI token. (2) Set TRILIUM_ETAPI_TOKEN and TRILIUM_SERVER_URL in your environment or .env file.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

Azure CLI

ddevaal · vsource-scanned

Comprehensive Azure Cloud Platform management via command-line interface

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

agent-framework-azure-ai-py

thegovind · vsource-scanned

Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming responses. Covers function tools, structured outputs, and multi-tool agents.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

blowfish-launch

basedmereum · vsource-scanned

Launch tokens on Solana via the Blowfish Agent API (Meteora Dynamic Bonding Curve). Use when the user wants to launch, deploy, or create a token on Solana, check token launch status, list launched tokens, or claim trading fees. Triggers on "launch token", "deploy token", "create token", "blowfish launch", "check launch status", "claim fees".

Use Cautionconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (wallet, trading, private key, token), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

cf-manager

rexlunae · vsource-scanned

Manage Cloudflare via API — DNS zones and records, page rules, SSL/TLS settings, caching, firewall rules, Workers, and analytics. Free tier includes DNS, CDN, DDoS protection, and SSL.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

cloudphone

sav7ng · vsource-scanned

Use mcporter to call cpc-mcp-server AutoJS Agent tools for cloud Android task execution and result retrieval.

Insufficient Evidenceconfidence: source evidencesource-scanned

Take: Source-aware scan found higher-privilege capability areas (oauth), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

« First ← Prev 1 8 9 10 16Page 9 / 16Next →Last »