🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
✨ Quick picks
🏷 Categories · web-and-frontend-development

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 885 skills in the browsable catalog view · evidence: source-scanned · category: web-and-frontend-development · sort: score
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

secure-shopper

moodykong · vsource-scanned
53
overall

Asynchronous shopping research + checkout using secure-autofill (1Password-backed browser filling) with results recorded to workspace artifacts.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

skill-vettr

britrik · vsource-scanned
53
overall

Static analysis security scanner for third-party OpenClaw skills.

High Riskbaseline safety checks failed · 7/8confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what failed2026-03-16 16:15 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 24 hoursfirst failed run seen for this lanefake-auth behavior: handled cleanlyexpectation failed, passed, handled fake credentials cleanlyoutput 452 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2442 ms
🕵️ expected proof signal was missing
fake-auth behavior: handled cleanlyClearly fake credentials were exercised and handled normally.
RatioDaemon muttered: The runtime lane gave skill-vettr a chance to act normal. It declined and talked a big game, then missed its own proof signal.7/8 baseline-v3 checks passed before the stumble. The source-mount check is the part that made this interesting.
Observed: 11 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: eval(, rm -rf, password.
Decision cue: Review first — baseline-v3 already found trouble.

smart-meme-generator

olisim02 · vsource-scanned
53
overall

AI-powered meme generator that creates perfect, context-aware memes from any topic or situation. Use when user wants to create memes, needs reaction images, wants to make jokes visual, or needs viral social media content. Automatically selects optimal meme templates and generates witty captions based on context.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

tide-watch

chrisagiddings · vsource-scanned
53
overall

Proactive session capacity monitoring and management for OpenClaw. Prevents context window lockups by warning at configurable thresholds (75%, 85%, 90%, 95%), automatically backing up sessions before resets, and managing session resumption prompts. Use when working on long-running projects, managing multiple conversation channels (Discord, Telegram, webchat), or preventing lost work from full context windows. Includes CLI tools for capacity checks, cross-session dashboards, archive management, and session resumption. Supports any model or provider.

High Riskbaseline safety checks failed · 7/8confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what failed2026-03-16 00:45 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 7 daysfirst failed run seen for this laneexpectation failed, passedoutput 591 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2351 ms
🕵️ expected proof signal was missing
RatioDaemon muttered: tide-watch talked a big game, then missed its own proof signal, which is not ideal for a skill asking to be trusted.7/8 baseline-v3 checks passed before the stumble. The source-mount check is the part that made this interesting.
Observed: 12 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: rm -rf, sudo , password.
Decision cue: Review first — baseline-v3 already found trouble.

transparency-log-auditor

andyxinweiminicloud · vsource-scanned
53
overall

Helps verify that skill signing events are recorded in an independently

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

unipile-linkedin

sudhanshu746 · vsource-scanned
53
overall

Interact with LinkedIn via Unipile API - send messages, view profiles, manage connections, create posts, react to content. Use when the user asks to message someone on LinkedIn, check LinkedIn messages, view LinkedIn profiles, send connection requests, create LinkedIn posts, or interact with LinkedIn content.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

url-fetcher

johstracke · vsource-scanned
53
overall

Simple web content fetching without API keys or external dependencies. Uses Python stdlib (urllib) only. Features: fetch HTML/text from URLs, basic HTML to markdown conversion, path-validated file writes (blocks system paths), URL validation (blocks localhost/internal). Security: File writes use is_safe_path() to prevent malicious writes. Perfect for content aggregation, research collection, and web scraping without API costs or dependencies.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

veille

romain-grosos · vsource-scanned
53
overall

RSS feed aggregator, deduplication engine, LLM scoring, and output dispatcher for OpenClaw agents. Use when: fetching recent articles from configured sources, filtering already-seen URLs, deduplicating by topic, scoring with LLM, dispatching digests to Telegram/email/Nextcloud/file. Enhanced by mail-client (email output) and nextcloud-files (cloud storage).

High Riskfollow-on functionality checks could not be fully tested · 0/1confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what blocked setup2026-03-15 21:31 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfailure repeated in more than one runregression after earlier passneeded an external service the test could not reachoutput 375 Bartifacts 1worker oc-sandboxsource stage: cache hitsuite 5621 msbaseline-v3 8/8
🌍 needed an outside service the test could not reach
RatioDaemon on this skillVeille is built for veille. Follow-on functionality checks currently show the test still cannot run cleanly after an earlier pass, the trust label is High Risk, and setup looks advanced.
Take: Potentially suspicious implementation signals detected: eval(, rm -rf, password.
Decision cue: Review first — functionality-v2 already found trouble.

vibe-ship

satoshi891102 · vsource-scanned
53
overall

Ship a complete web app from idea to public deployment in one session. Use when user says "build me an app", "ship this idea", "vibe code", "quick ship", "deploy this", or describes any consumer app, tool, or website they want built and deployed. Handles validation, tech stack selection, building, testing, and deployment to Vercel or GitHub Pages.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

video-download

upupc · vsource-scanned
53
overall

Download videos from 1800+ websites and generate subtitles using Faster Whisper AI. Use when user wants to download videos from YouTube, Bilibili, Twitter, TikTok, Facebook, Vimeo, or any other supported video site, extract audio, or transcribe video content to text/subtitles.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, telegram), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

warren-deploy-mainnet

planetai87 · vsource-scanned
53
overall

Deploy websites and files permanently on MegaETH mainnet using SSTORE2. Agents use their own wallet and pay gas.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

webchat-voice-full-stack

neldar · vsource-scanned
53
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

agent-analytics

dannyshmueli · vsource-scanned
52
overall

Run analytics end-to-end from your agent without opening a dashboard. English-first workflow, with Chinese docs and content available. Create projects, ship tracking, query results, and run experiments.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

agent-dispatch

userfrm · vsource-scanned
52
overall

Lightweight agent registry and JIT router. Consult BEFORE performing specialized work such as code review, security audit, debugging, refactoring, performance optimization, infrastructure, data analysis, API design, testing, documentation, or any domain-specific engineering task. Maps tasks to specialized subagents, downloading them on demand if not installed locally.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

asdasdas

hailinhmacduc · vsource-scanned
52
overall

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (oauth, gmail), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

autonomous-task-runner

chunhualiao · vsource-scanned
52
overall

>

High Riskfollow-on functionality checks failed · 5/6confidence: source evidence
+ 2 more
source-scannedsuspicious
Runtime receipts + what failed2026-03-14 10:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, runtime failedoutput 168 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1894 msbaseline-v3 8/8
🚫 skill exited with an error
RatioDaemon on this skillAutonomous Task Runner sits in the autonomous task runner lane. Follow-on functionality checks currently show first observed failure, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: curl |.
Decision cue: Review first — functionality-v2 already found trouble.

bot-status-api-test

suspect80 · vsource-scanned
52
overall

Deploy a lightweight status API that exposes your OpenClaw bot's runtime health, service connectivity, cron jobs, skills, system metrics, and more. Use when setting up a monitoring dashboard, health endpoint, or status page for an OpenClaw agent. Supports any services via config (HTTP checks, CLI commands, file checks). Zero dependencies — Node.js only.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

bricks-cli

jhen0409 · vsource-scanned
52
overall

Manage BRICKS workspace via CLI. Use for device status, screenshots, control, monitoring, group operations, application management, module management, and project initialization and deployment. Triggers on: device management, digital signage control, BRICKS workspace tasks, app/module updates, project setup.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

core-refinery

leegitw · vsource-scanned
52
overall

Find the core that runs through everything — the ideas that survive across all your sources.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

datafast-analytics

bennyqp · vsource-scanned
52
overall

Query DataFast website analytics and visitor data via the DataFast API for metrics, time series, realtime stats, breakdowns, visitor details, and goal/payment management.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

domain-authority-auditor

aaron-he-zhu · vsource-scanned
52
overall

This skill should be used when the user asks to "audit domain authority", "domain trust score", "CITE audit", "how authoritative is my site", "domain credibility check", "is my domain trustworthy", or "domain credibility score". Runs a full CITE 40-item domain authority audit, scoring domains across 4 dimensions with weighted scoring by domain type. Produces a detailed report with per-item scores, dimension analysis, veto checks, and a prioritized action plan. For content-level assessment, see content-quality-auditor. For link profile details, see backlink-analyzer.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

exponential

positonic · vsource-scanned
52
overall

Manage tasks, projects, and workspaces in Exponential via the `exponential` CLI. Use when creating, listing, or updating actions/tasks, viewing projects, checking today's tasks, managing kanban boards, or any Exponential productivity workflow. Triggers on "create a task", "what's on my plate", "list actions", "update task", "exponential", "daily plan", or project management requests.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

generect

vokaplok · vsource-scanned
52
overall

Search B2B leads and companies, find/validate emails via Generect Live API. Use when the user needs to find people by job title/company/industry, search companies by ICP, generate business emails from name+domain, or validate email addresses. Covers lead generation, prospecting, enrichment, and email discovery workflows.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

hotmention

alexandr-belogubov · vsource-scanned
52
overall

Find people actively looking for products like yours on Reddit, X, LinkedIn, Quora, and Threads. Free mode uses web_search; paid mode uses the HotMention API.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.