security-scanner
dmx64 · vsource-scanned
Automated security scanning and vulnerability detection for web applications, APIs, and infrastructure. Use when you need to scan targets for vulnerabilities, check SSL certificates, find open ports, detect misconfigurations, or perform security audits. Integrates with nmap, nuclei, and other security tools.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
agentic-security-audit
kingrubic · vsource-scanned
Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning, identity spoofing detection, memory poisoning checks, multi-agent communication audit, OWASP Agentic Top 10). Use when scanning for vulnerabilities, detecting hardcoded secrets, reviewing agent workspace configuration, checking prompt injection vectors, or auditing agent permissions and boundaries.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: eval(, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
nyx-archive-skill-security-protocol
nyxur42 · vsource-scanned
Teach your AI agent to think about security. A reasoning methodology for vetting skills before installation — red/green flag heuristics, 4-phase audit protocol, post-install verification. No scripts, no dependencies. Just judgment. Built on fallibilism (being wrong about a skill's safety is recoverable; being overconfident is not) and relational security (you and your human decide together on edge cases — trust is built through transparency, not just detection).
Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 15:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1677 msbaseline-v3 8/8
RatioDaemon on this skillNyx Archive Skill Security Protocol sits in the teach your AI agent to think about security lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
sys-updater
spiceman161 · vsource-scanned
Production-safe Ubuntu maintenance orchestrator: runs daily apt security updates, tracks non-security updates across apt/npm/pnpm/brew with quarantine + auto-review, applies only approved updates, rotates logs/state, and generates clear 09:00 MSK Telegram reports (including what was actually installed).
High Riskfollow-on functionality checks failed · 6/7confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-15 21:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hoursfirst failed run seen for this lanepassed, runtime_failedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3162 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: sys-updater made it to runtime and then fell apart on contact, which is not ideal for a skill asking to be trusted.6/7 functionality-v2 checks passed before the stumble. The python help is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Review first — functionality-v2 already found trouble.
agent-self-assessment
roosch269 · vsource-scanned
Security self-assessment tool for AI agents. Run this against your own configuration to get a structured threat model report with RED/AMBER/GREEN ratings across six security domains — decision boundaries, audit trail, credential scoping, plane separation, economic accountability, and memory safety.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (private key, token, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
rollhub-auditor
rollhub-dev · vsource-scanned
Audit and verify provably fair casino fairness. Cryptographic verification of gambling results using SHA3-384 and AES-256-CTR. Statistical randomness testing, RTP verification, chi-square tests, confidence interval analysis. Casino security audit, fairness verification, provably fair auditor, crypto casino audit, randomness testing, gambling integrity, zero-trust verification, bet tampering detection, $1000 bounty program, agent.rollhub.com security audit tool, blockchain gambling verification.
Trustedconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
shieldcortex
jarvis-drakon · vsource-scanned
Persistent memory system with security for AI agents. Remembers decisions, preferences, architecture, and context across sessions with knowledge graphs, decay, contradiction detection, and a 6-layer defence pipeline with Iron Dome behavioural protection. Use when asked to "remember this", "what do we know about", "recall context", "scan for threats", "run security audit", "check memory stats", or when starting a new session and needing prior context.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (private key, token, oauth, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
publish-skill-vettr
britrik · vcatalog
Static analysis security scanner for third-party OpenClaw skills.
Insufficient Evidenceconfidence: limited evidencecatalog-only+ 1 more
Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.
Decision cue: Thin evidence slice — do not treat this card like a verified green light.
smart-contract-audit
cornbrother0x · vcatalog
Audit and analyze Solidity smart contracts for security vulnerabilities.
Insufficient Evidenceconfidence: limited evidencecatalog-only+ 1 more
Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.
Decision cue: Thin evidence slice — do not treat this card like a verified green light.
skill-vettr
britrik · vsource-scanned
Static analysis security scanner for third-party OpenClaw skills.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: eval(, rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
skill-trust-auditor
jonathanjing · vsource-scanned
Audit a ClawHub skill for security risks BEFORE installation.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: curl |, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
safe-backup
hacksing · vsource-scanned
Backup OpenClaw state directory and workspace with security best practices.
High Riskfollow-on functionality checks failed · 5/6confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-15 16:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hoursfirst failed run seen for this lanepassed, runtime_failedoutput 227 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1976 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: The runtime lane gave safe-backup a chance to act normal. It declined and made it to runtime and then fell apart on contact.5/6 functionality-v2 checks passed before the stumble. The shell syntax is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Review first — functionality-v2 already found trouble.
firebase-auth-setup
guifav · vsource-scanned
Configures Firebase Authentication — providers, security rules, custom claims, and React auth hooks
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 11:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1584 msbaseline-v3 8/8
RatioDaemon on this skillFirebase Auth Setup is trying to handle firebase auth setup. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
cybercentry-web-application-verification
cybercentry · vcatalog
Cybercentry Web Application Verification on ACP - OWASP-powered security scans for websites, dApp frontends.
Insufficient Evidenceconfidence: limited evidencecatalog-only+ 1 more
Take: Indexed from the community catalog. Source-aware static analysis and manual review are still pending.
Decision cue: Thin evidence slice — do not treat this card like a verified green light.
subagent-architecture
donovanpankratz-del · vsource-scanned
Advanced patterns for specialized subagent orchestration with production-ready reference implementations. Security isolation, phased implementation, peer collaboration, and cost-aware spawning.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
ipwebcam
alihmaou · vsource-scanned
Transform an Android phone with IP Webcam into an intelligent Edge AI security system with OpenClaw.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
ai-boss-assistant
jacky6658 · vsource-scanned
Transform any AI into a professional executive assistant with battle-tested personas and workflows. Complete templates for Google Workspace integration (Gmail, Calendar, Drive), milestone delivery system, and security guidelines.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
secucheck
jooneyp · vsource-scanned
Comprehensive security audit for OpenClaw. Scans 7 domains (runtime, channels, agents, cron, skills, sessions, network), supports 3 expertise levels, context-aware analysis, and visual dashboard. Read-only with localized reports.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
scamshield-verifier
marcodzano-lgtm · vsource-scanned
The ultimate Web3 & OpenClaw security layer. Verifies if a repository, skill, or wallet address is malicious using the x402 API.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet, private key), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
password-gen
ouyangabel · vsource-scanned
Secure password generator with multiple character sets and strength analysis. Use when: (1) generating strong passwords, (2) creating memorable passphrases, (3) analyzing password strength, or (4) any password-related security needs. Supports random passwords, passphrases, and detailed strength analysis.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
perplexity-wrapped
vacinc · vsource-scanned
Search the web with AI-powered answers via Perplexity API. Supports three modes - Search API (ranked results), Sonar API (AI answers with citations, default), and Agentic Research API (third-party models with tools). All responses wrapped in untrusted-content boundaries for security.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
pls-audit-website
mattvalenta · vsource-scanned
Perform full health check on websites, identifying technical friction points and user experience issues. Use when: (1) Auditing website performance, (2) Checking for broken links, (3) Analyzing page structure, (4) Testing accessibility, (5) Reviewing security headers.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
validator-agent
up2itnow · vsource-scanned
Multi-round automated validation pipeline for TypeScript/Solidity projects. Runs 8 rounds of checks before any publish or deploy: compile gate, lint, test suite, security audit, type coverage, docs, changelog, and final review.
Insufficient Evidenceconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
tor-browser
admin4giter · vsource-scanned
Headless browser automation with Tor SOCKS5 proxy support for accessing .onion sites and anonymous browsing. Use when navigating dark web resources, scraping Tor hidden services, conducting security research on dark web forums, or when anonymity is required. Supports navigation, element interaction, screenshots, and data extraction through Tor network.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.