🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
✨ Quick picks
🏷 Categories · web-and-frontend-development

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 885 skills in the browsable catalog view · evidence: source-scanned · category: web-and-frontend-development · sort: score
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

solid-agent-storage

masterworrall · vsource-scanned
57
overall

Give your AI agent persistent identity (WebID) and personal data storage (Pod) using the Solid Protocol

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: eval(, password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

soul-pack

gyliiiiii · vsource-scanned
57
overall

Export and import SOUL packages for OpenClaw agents. Use when creating a reusable persona package (SOUL.md + preview.md + manifest.json), installing a soul package into a new/existing agent workspace, or batch listing local soul packages for a Soul marketplace workflow.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

spirit

gopinathnelluri · vsource-scanned
57
overall

|

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

stonebornbot

olawoyin206 · vsource-scanned
57
overall

High-speed NFT mint bot for Ethereum and EVM chains. Use when the user wants to snipe NFT mints, speed-mint collections, set up multi-wallet minting bots, configure mint sniping with pre-signed transactions, or automate NFT minting across multiple wallets. Supports ERC721A, Archetype contracts, Flashbots, war mode gas, WebSocket monitoring, mempool watching, and batch minting with 100+ wallets.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: curl |.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

subagent-overseer

globalcaos · vsource-scanned
57
overall

You spawned 4 sub-agents. One died 20 minutes ago. You're still waiting. Overseer watches them so you don't have to — zero tokens, pure OS-level process checks. No polling loops, no wasted heartbeats.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

sys-updater

spiceman161 · vsource-scanned
57
overall

Production-safe Ubuntu maintenance orchestrator: runs daily apt security updates, tracks non-security updates across apt/npm/pnpm/brew with quarantine + auto-review, applies only approved updates, rotates logs/state, and generates clear 09:00 MSK Telegram reports (including what was actually installed).

High Riskfollow-on functionality checks failed · 6/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test found2026-03-15 21:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, runtime failedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3162 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon on this skillSys Updater is built for sys updater. Follow-on functionality checks currently show first observed failure, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Review first — functionality-v2 already found trouble.

using-git-worktrees

zlc000190 · vsource-scanned
57
overall

Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

virtual-remote-desktop

zhangxin15435 · vsource-scanned
57
overall

KasmVNC-based virtual desktop for headless Linux with AI-first automation and human handoff. Use when most steps are automated but a user must manually intervene for captcha/risk-control/login approval, then return to automation. Includes requirement-driven setup for mobile/desktop takeover and browser mobile/desktop rendering.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

wallet

kenblive · vsource-scanned
57
overall

🔐 Base Wallet - Crypto Identity for AI Agents. Create wallets, sign messages (SIWE), send transactions programmatically. No browser extensions, no human intervention. The foundation for autonomous Web3 agents.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

website-generator

clowreed · vsource-scanned
57
overall

This skill allows you to create a professional, engaging, and user-friendly website in seconds using AI. To create a website, you need to provide a name for your project/business, along with a description of the project/business (goals, structure, etc.).

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

website-usability-test-nova-act

adityak6798 · vsource-scanned
57
overall

AI-orchestrated usability testing using Amazon Nova Act. The agent generates personas, runs tests to collect raw data, interprets responses to determine goal achievement, and generates HTML reports. Tests real user workflows (booking, checkout, posting) with safety guardrails. Use when asked to "test website usability", "run usability test", "generate usability report", "evaluate user experience", "test checkout flow", "test booking process", or "analyze website UX".

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

wreckit-ralph

christiancattaneo · vsource-scanned
57
overall

>

High Riskfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 14:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2256 msbaseline-v3 8/8
RatioDaemon on this skillWreckit Ralph looks aimed at wreckit ralph. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

agent-passport

markneville · vsource-scanned
56
overall

OAuth for the agentic era. Consent-gating for ALL sensitive agent actions. 75+ data-driven threat definitions with auto-updates (like antivirus signatures). Includes Skill Scanner, Injection Shield, SSRF Shield, Path Traversal Guard, spending caps, rate limits, allowlists, TTL expiry, audit trails, and KYA metadata. Pro tier adds real-time threat definition updates every 6 hours.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf, sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

anti-pattern-czar

glucksberg · vsource-scanned
56
overall

Detect and fix TypeScript error handling anti-patterns with state persistence and approval workflows. Use when scanning a codebase for silent error failures, empty catches, promise swallowing, or unlogged errors. Supports five modes — scan (detect all issues), review (interactive fix session), auto (batch fix with guardrails), resume (continue from last session), report (show progress). Triggers on phrases like 'scan for anti-patterns', 'fix error handling', 'find empty catches', 'anti-pattern czar', or 'check error handling'.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

bunpro-sync

mart1n-xyz · vsource-scanned
56
overall

Sync Bunpro Japanese grammar learning progress from the API to local storage for analysis and insights. Use when the user wants to backup their Bunpro progress, track grammar mastery, analyze review patterns, or monitor JLPT level progression. Works with the community-documented Bunpro Frontend API.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

call-web-search-agent-strategy

alvinecarn · vsource-scanned
56
overall

AI agent for call web search agent strategy tasks

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

claude-agent-team-workflows

doanbactam · vsource-scanned
56
overall

Universal multi-agent workflow orchestration using Claude Code Agent Teams. Use when user asks to run a team workflow, create an agent team, or coordinate parallel work across multiple teammates — for any domain (software, content, data, strategy, research, etc.).

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

cloudflare-toolkit

insipidpoint · vsource-scanned
56
overall

Manage Cloudflare domains, DNS records, SSL settings, zone configuration, firewall rules, tunnels, and analytics via the Cloudflare API. Use when the user asks to set up a domain, add/edit/delete DNS records, configure SSL, check zone settings, manage Cloudflare Tunnels, view analytics, or any Cloudflare account management task.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

desearch-ai-search

okradze · vsource-scanned
56
overall

AI-powered search that aggregates and summarizes results from multiple sources including web, X/Twitter, Reddit, Hacker News, YouTube, ArXiv, and Wikipedia. Use this when you need a synthesized answer or curated links from across the internet and social platforms.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

digitalocean

rexlunae · vsource-scanned
56
overall

Manage DigitalOcean resources via API — Droplets (create/destroy/resize/power), DNS zones and records, Spaces (object storage), Databases, Firewalls, Load Balancers, Kubernetes, and account/billing info.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

email-intelligence

pfrederiksen · vsource-scanned
56
overall

Analyze email inbox health with weather metaphors, spam/signal classification, email debt scoring, and ghost detection. Use when user asks about inbox status, email overwhelm, who they're ghosting, or email time cost. Requires himalaya CLI configured with IMAP.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (gmail, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

google-tag-manager

simonfunk · vsource-scanned
56
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

myosin-hivemind

divine-comedian · vsource-scanned
56
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

next-cache-components

tuanvidev · vsource-scanned
56
overall

Next.js 16 Cache Components - PPR, use cache directive, cacheLife, cacheTag, updateTag

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.