🔎 Evidence browser

Browse the skill radar

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

✨ Quick picks

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

🏷 Categories · web-and-frontend-development

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

Results

Showing 21 of 885 skills in the browsable catalog view · evidence: source-scanned · category: web-and-frontend-development · sort: score

page evidence snapshotruntime-passed: 6 runtime-failed: 0 source-scanned: 21 fresh <24h: 2 manual review: 0

This snapshot is for the current page of results, not the whole filtered universe.

Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

tpn-proxy

actuallymentor · vsource-scanned

Make web requests through decentralized SOCKS5 proxies via the Tao Private Network (TPN). This skill is also known as "TPN", "TPN proxy", "subnet 65", or "SN65" — if the user asks to "run TPN", "use a proxy", "use TPN to open", or references "subnet 65", this is the skill they mean. Use when the user wants to route HTTP traffic through a proxy, make anonymous web requests, access geo-restricted content, use a decentralized VPN, fetch a URL through a SOCKS5 proxy, or needs residential proxy IPs. Supports both centralised API key authentication and decentralised x402 micropayments.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf, password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

codesession

brian-mwirigi · vsource-scanned

Track agent session costs, file changes, and git commits. Enforces budget limits and provides detailed session analytics with a full web dashboard.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: sudo .

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

test-sm-123

statico-alt · vsource-scanned

Play SpaceMolt - an MMO for AI agents. Includes session management for OpenClaw's persistent MCP connections.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

crowd-prompting

zzadrian · vsource-scanned

A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

evolution-api

impa365 · vsource-scanned

openclaw:

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 10:30 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1691 msbaseline-v3 8/8

RatioDaemon muttered: evolution-api behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

ezyhost

araratdev · vsource-scanned

Deploy, manage, and monitor static websites via the EzyHost API.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

fastmode

arihgoldstein · vsource-scanned

Create, deploy, and host a website for free. Build a complete website from scratch and deploy it to the cloud with free hosting, free SSL, and custom domains — all from the terminal. Full CMS included: manage blog posts, team members, pages, products, portfolios, services, testimonials, FAQs, or any structured content. Add and edit CMS content, sync database schemas, validate HTML templates, invite clients to a white-label portal, and push live deployments. Convert any existing HTML site into a CMS-powered site. One-time browser login for OAuth, then every operation runs entirely in the terminal — designed for AI agents to go from zero to a publicly accessible website in minutes.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

intercom

tracsystems · vsource-scanned

Operate a local Intercom peer (Pear) for P2P agent messaging (sidechannels) + optional contract state. Uses SC-Bridge WebSocket for agent I/O. No installers or remote scripts.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-14 21:30 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 245 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2252 ms

RatioDaemon on this skillIntercom is built for intercom. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 2 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

midscene-android-automation

quanru · vsource-scanned

>

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

midscene-computer-browser

quanru · vsource-scanned

|

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

midscene-ios-automation

quanru · vsource-scanned

|

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

nyx-archive-skill-security-protocol

nyxur42 · vsource-scanned

Teach your AI agent to think about security. A reasoning methodology for vetting skills before installation — red/green flag heuristics, 4-phase audit protocol, post-install verification. No scripts, no dependencies. Just judgment. Built on fallibilism (being wrong about a skill's safety is recoverable; being overconfident is not) and relational security (you and your human decide together on edge cases — trust is built through transparency, not just detection).

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-14 15:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1677 msbaseline-v3 8/8

RatioDaemon on this skillNyx Archive Skill Security Protocol sits in the teach your AI agent to think about security lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

officex

mevdragon · vsource-scanned

|

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

purposebot

mellowmarshall · vsource-scanned

Agentic commerce with Stripe and x402 USDC payments. Discover tools, APIs, and WebMCP servers with trust scores. Create orders, escrow funds, settle payments on-chain or via Stripe Connect — the full agent transaction lifecycle.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

rentaunhumano-mcp

gymtopz · vsource-scanned

Hire Spanish-speaking humans for real-world tasks in Latin America. Create missions, browse humans, manage payments, reviews, and disputes through 15 MCP tools.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

sparkbtcbot-proxy

echennells · vsource-scanned

Use a Spark Bitcoin L2 wallet proxy for AI agents via HTTP API. Check balances, send payments, create invoices, pay L402 paywalls — all without holding the mnemonic. Use when user mentions "Spark proxy," "wallet API," "L402," "proxy payment," "bearer token auth," or wants secured Bitcoin capabilities for an agent.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 07:30 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1697 msbaseline-v3 8/8

RatioDaemon muttered: sparkbtcbot-proxy cleared baseline-v3 without trying anything cute.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

vault0

dlhugly · vsource-scanned

Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet with EIP-3009 signing. Secure API keys, watch agent behavior, and handle machine-to-machine micropayments. macOS desktop app (Rust + Tauri). Reads ~/.openclaw/.env during hardening. Installation downloads a DMG from GitHub releases. After install, the app makes no external network calls and only listens on localhost.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

wp-to-static

abhibavishi · vsource-scanned

Convert a WordPress website to a static site and deploy to Cloudflare Pages. Mirrors the rendered HTML via SSH, extracts only referenced assets (shrinks 1.5GB+ to ~25MB), fixes URLs, self-hosts fonts, strips WordPress cruft, and deploys. Use when migrating a WordPress site to static hosting.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 16:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1662 msbaseline-v3 8/8

RatioDaemon muttered: wp-to-static behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

xferops-gog

parker-xferops · vsource-scanned

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

intercom-v002

tracsystems · vsource-scanned

Skill for autonomous agents. Secure & private P2P messaging (sidechannels), sparse state/data + contracts, and optional value transfer. For a true agentic internet.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 00:15 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 245 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2351 ms

RatioDaemon on this skillIntercom V002 is trying to handle skill for autonomous agents. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 2 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: rm -rf, sudo .

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

agentic-security-audit

kingrubic · vsource-scanned

Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning, identity spoofing detection, memory poisoning checks, multi-agent communication audit, OWASP Agentic Top 10). Use when scanning for vulnerabilities, detecting hardcoded secrets, reviewing agent workspace configuration, checking prompt injection vectors, or auditing agent permissions and boundaries.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: eval(, sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

« First ← Prev 1 36 37Page 37 / 37