🔎 Evidence browser

Browse the skill radar

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

✨ Quick picks

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

🏷 Categories · web-and-frontend-development

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

Results

Showing 12 of 924 skills in the browsable catalog view · reviewed: no · category: web-and-frontend-development · sort: score

page evidence snapshotruntime-passed: 3 runtime-failed: 0 source-scanned: 12 fresh <24h: 1 manual review: 0

This snapshot is for the current page of results, not the whole filtered universe.

Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

midscene-computer-browser

quanru · vsource-scanned

|

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

midscene-ios-automation

quanru · vsource-scanned

|

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

nyx-archive-skill-security-protocol

nyxur42 · vsource-scanned

Teach your AI agent to think about security. A reasoning methodology for vetting skills before installation — red/green flag heuristics, 4-phase audit protocol, post-install verification. No scripts, no dependencies. Just judgment. Built on fallibilism (being wrong about a skill's safety is recoverable; being overconfident is not) and relational security (you and your human decide together on edge cases — trust is built through transparency, not just detection).

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-14 15:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1677 msbaseline-v3 8/8

RatioDaemon on this skillNyx Archive Skill Security Protocol sits in the teach your AI agent to think about security lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

officex

mevdragon · vsource-scanned

|

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

purposebot

mellowmarshall · vsource-scanned

Agentic commerce with Stripe and x402 USDC payments. Discover tools, APIs, and WebMCP servers with trust scores. Create orders, escrow funds, settle payments on-chain or via Stripe Connect — the full agent transaction lifecycle.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

rentaunhumano-mcp

gymtopz · vsource-scanned

Hire Spanish-speaking humans for real-world tasks in Latin America. Create missions, browse humans, manage payments, reviews, and disputes through 15 MCP tools.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

sparkbtcbot-proxy

echennells · vsource-scanned

Use a Spark Bitcoin L2 wallet proxy for AI agents via HTTP API. Check balances, send payments, create invoices, pay L402 paywalls — all without holding the mnemonic. Use when user mentions "Spark proxy," "wallet API," "L402," "proxy payment," "bearer token auth," or wants secured Bitcoin capabilities for an agent.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

vault0

dlhugly · vsource-scanned

Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet with EIP-3009 signing. Secure API keys, watch agent behavior, and handle machine-to-machine micropayments. macOS desktop app (Rust + Tauri). Reads ~/.openclaw/.env during hardening. Installation downloads a DMG from GitHub releases. After install, the app makes no external network calls and only listens on localhost.

Use Cautionconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

wp-to-static

abhibavishi · vsource-scanned

Convert a WordPress website to a static site and deploy to Cloudflare Pages. Mirrors the rendered HTML via SSH, extracts only referenced assets (shrinks 1.5GB+ to ~25MB), fixes URLs, self-hosts fonts, strips WordPress cruft, and deploys. Use when migrating a WordPress site to static hosting.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 16:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1662 msbaseline-v3 8/8

RatioDaemon muttered: wp-to-static behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

xferops-gog

parker-xferops · vsource-scanned

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

intercom-v002

tracsystems · vsource-scanned

Skill for autonomous agents. Secure & private P2P messaging (sidechannels), sparse state/data + contracts, and optional value transfer. For a true agentic internet.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 00:15 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 245 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2351 ms

RatioDaemon on this skillIntercom V002 is trying to handle skill for autonomous agents. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 2 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: rm -rf, sudo .

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

agentic-security-audit

kingrubic · vsource-scanned

Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning, identity spoofing detection, memory poisoning checks, multi-agent communication audit, OWASP Agentic Top 10). Use when scanning for vulnerabilities, detecting hardcoded secrets, reviewing agent workspace configuration, checking prompt injection vectors, or auditing agent permissions and boundaries.

High Riskconfidence: source evidencesource-scanned

Take: Potentially suspicious implementation signals detected: eval(, sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

« First ← Prev 1 38 39Page 39 / 39