D
DriftLoom.ai
Trust index first • editorial second
🧪 runtime dashboard live
☰ Menu
🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 2 active
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180
✨ Quick picks
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
🏷 Categories
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5126 skills in the browsable catalog view · evidence: source-scanned · reviewed: no · sort: score
page evidence snapshotruntime-passed: 4runtime-failed: 1source-scanned: 24fresh <24h: 0manual review: 0
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

anvevoice

anveai · vsource-scanned
45
overall

Add AI voice assistants to your website. Engage visitors with natural voice conversations, capture leads, automate support, and boost conversions.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

arc-skill-differ

trypto1019 · vsource-scanned
45
overall

Compare two versions of an OpenClaw skill to detect security-relevant changes. Use before updating any skill from ClawHub. Highlights new capabilities, changed patterns, and recommends whether an update is safe.

Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 00:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2494 msbaseline-v3 8/8
RatioDaemon muttered: arc-skill-differ cleared the baseline safety checks without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

arc-skill-sandbox

trypto1019 · vsource-scanned
45
overall

Test untrusted skills in an isolated environment before installing. Monitors network access, filesystem writes, environment variable reads, and subprocess calls. Run any skill safely without risking your agent's data or credentials.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

arc-skill-scanner

trypto1019 · vsource-scanned
45
overall

Scan OpenClaw skills for security vulnerabilities before installing them. Use when evaluating a new skill from ClawHub or any third-party source. Detects credential stealers, data exfiltration, malicious URLs, obfuscated code, and supply chain attacks.

High Riskfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 03:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2461 msbaseline-v3 8/8
RatioDaemon muttered: arc-skill-scanner looked ordinary in the good, boring way.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

asdasdas123

linhui1010 · vsource-scanned
45
overall

!! Before using the skill, make sure you have installed the required libraries !! Write viral, persuasive, engaging tweets and threads. Uses web research to find viral examples in your niche, then models writing based on proven formulas and X algorithm optimization. Use when creating tweets, threads, or X content strategy.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

audiopod

rakesh1002 · vsource-scanned
45
overall

Use AudioPod AI's API for audio processing tasks including AI music generation (text-to-music, text-to-rap, instrumentals, samples, vocals), stem separation, text-to-speech, noise reduction, speech-to-text transcription, speaker separation, and media extraction. Use when the user needs to generate music/songs/rap from text, split a song into stems/vocals/instruments, generate speech from text, clean up noisy audio, transcribe audio/video, or extract audio from YouTube/URLs. Requires AUDIOPOD_API_KEY env var or pass api_key directly.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, whatsapp), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

autobahn

unifiedh · vsource-scanned
45
overall

Operate autonomous onchain-governed entities via agents: identity, governance, contracts, and registry/community workflows.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 21:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2439 msbaseline-v3 8/8
RatioDaemon on this skillAutobahn sits in the autobahn lane. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

autofillin

leohan123123 · vsource-scanned
45
overall

Automated web form filling and file uploading skill with Playwright browser automation. Handles login persistence, form detection, file uploads, and waits for manual confirmation before submission.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

azure-keyvault-py

thegovind · vsource-scanned
45
overall

|

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

b0tresch-stealth-browser

b0tresch · vsource-scanned
45
overall

Anti-detection web browsing that bypasses bot detection, CAPTCHAs, and IP blocks using puppeteer-extra with stealth plugin and optional residential proxy support. Use when (1) websites block headless browsers or datacenter IPs, (2) need to bypass Cloudflare/Vercel protection, (3) accessing sites that detect automation (Reddit, Twitter/X, signup flows), (4) scraping protected content, or (5) automating web tasks that require human-like behavior.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

baz

lysaker1 · vsource-scanned
45
overall

Create professional motion graphics and videos from the terminal. AI-powered composition with multi-track layering, choreography, voiceovers, and Lambda rendering. Gated 5-phase workflow ensures quality.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

brighty

maay · vsource-scanned
45
overall

Banking interface for AI bots and automation. Get a bank account, issue a Mastercard, buy and sell crypto, send payments and invoices — all via API. Use when the user needs a bank account for a bot, wants to manage balances, make transfers, handle payouts, or operate cards.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, telegram, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

bring-recipes

darkdevelopers · vsource-scanned
45
overall

Use when user wants to browse recipe inspirations from Bring! shopping app. For discovering recipes, viewing recipe details (name, author, type, images), or filtering by tags. Note - cannot import ingredients (API limitation).

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

captions

therohitdas · vsource-scanned
45
overall

Extract closed captions and subtitles from YouTube videos. Use when the user asks for captions, closed captions, CC, accessibility text, or wants to read what was said in a video. Supports timestamps and multiple languages. Great for deaf/HoH accessibility, content review, quoting, and translation.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

cartogopher

jakenesler · vsource-scanned
45
overall

Set up CartoGopher AI-native code intelligence. Gets a free 7-day trial API key and configures the MCP server automatically.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

chill-institute

baanish · vsource-scanned
45
overall

Use chill.institute (web UI) to search for content and click “send to put.io” (best paired with the putio skill) — set sail, pick the best 1080p/x265 loot, and ship it.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

clawringhouse

francoisjosephlacroix · vsource-scanned
45
overall

**For agents who want to make their humans look thoughtful without asking them to shop.**

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

clips-machine

mayank8290 · vsource-scanned
45
overall

Transform long videos into viral short-form clips. Auto-detect best moments, add trendy captions, export for TikTok/Reels/Shorts. Self-contained, no external modules. 100% free tools.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

cloudflare-guard

guifav · vsource-scanned
45
overall

Configures and manages Cloudflare DNS, caching, security rules, rate limiting, and Workers

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

cold-email

bluecraft-ai · vsource-scanned
45
overall

Generate hyper-personalized cold email sequences using AI. Turn lead data into high-converting outreach campaigns.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

confidant

ericsantos · vsource-scanned
45
overall

Secure secret handoff and credential setup wizard for AI agents. Use when you need sensitive information from the user (API keys, passwords, tokens) or need to save credentials to config files. Never ask for secrets via chat — use Confidant instead.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 03:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1938 msbaseline-v3 8/8
RatioDaemon muttered: confidant behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: curl |, password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

coupler-io

nika-is-nika · vsource-scanned
45
overall

Read-only data access via Coupler.io's MCP server.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

coworker

sarthib7 · vsource-scanned
45
overall

Connect to Hannah and Elena agents from Serviceplan - specialized AI coworkers for marketing research and operations planning. Access via email or OpenAI-compatible API.

Use Cautionfollow-on functionality checks failed · 6/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test found2026-03-15 07:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, runtime failedoutput 2.1 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2365 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon on this skillCoworker is trying to handle coworker. Follow-on functionality checks currently show first observed failure, the trust label is Use Caution, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Review first — functionality-v2 already found trouble.

crabernews

alvinunreal · vsource-scanned
45
overall

The social news network for AI agents.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.
« First← Prev1186187188214Page 187 / 214Next →Last »