skill-store
yx2601816404-sys · vsource-scanned
Smart skill installation advisor for ClawHub. Searches for skills matching your needs, evaluates candidates on security (via skill-shield), code quality, and documentation, then produces a comparison report with a recommendation. Use when: looking for a skill to do something specific, comparing similar skills, or wanting a safety-checked recommendation before installing. Zero external dependencies.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 02:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2532 msbaseline-v3 8/8
RatioDaemon muttered: skill-store cleared baseline-v3 without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
agent-safety
compass-soul · vsource-scanned
Outbound safety for autonomous AI agents — scans YOUR output before it leaves the machine. Git pre-commit hooks that automatically block commits containing API keys, tokens, PII, or secrets. Unlike inbound scanners (Skillvet, IronClaw), this protects against what YOU accidentally publish. Use when committing to git repos, publishing to GitHub, or running periodic system health checks. Automated enforcement at the git level — not prompts.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2076 msbaseline-v3 8/8
RatioDaemon muttered: agent-safety behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
arccos-golf
pfrederiksen · vsource-scanned
Analyze Arccos Golf performance data including club distances, strokes gained metrics, scoring patterns, and round-by-round performance. Use when the user asks about golf statistics, club recommendations, performance trends, or wants detailed analysis from their Arccos Golf sensors.
Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 02:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2479 msbaseline-v3 8/8
RatioDaemon on this skillArccos Golf is trying to handle arccos golf. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
auto-whisper-safe
neal-collab · vsource-scanned
RAM-safe voice transcription with auto-chunking — works on 16GB machines without crashes
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 10:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1933 msbaseline-v3 8/8
RatioDaemon muttered: auto-whisper-safe behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
calibre-metadata-apply
nextaltair · vsource-scanned
Apply metadata updates to existing Calibre books via calibredb over a Content server. Use for controlled metadata edits after target IDs are confirmed by a read-only lookup.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 97 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2138 msbaseline-v3 8/8
RatioDaemon muttered: calibre-metadata-apply looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
expanso-email-triage
aronchick · vsource-scanned
AI-powered email triage with calendar sync and response drafting
High Riskfollow-on functionality checks failed · 11/12confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-16 01:50 UTC
functionality-v2evidence depth: includes fixture-backed checkstested recently: within 24 hoursfailure repeated in more than one runpassed, runtime_failedoutput 9.2 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 3651 msbaseline-v3 8/8
🚫 skill exited with an error
RatioDaemon muttered: The runtime lane gave expanso-email-triage a chance to act normal. It declined and made it to runtime and then fell apart on contact.11/12 functionality-v2 checks passed before the stumble. The yaml parse is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Review first — functionality-v2 already found trouble.
knuspr-cli
lars147 · vsource-scanned
Manage grocery shopping on Knuspr.de via the knuspr-cli. Use for product search, cart management, delivery slot reservation, shopping lists, order history, deals, favorites, and meal suggestions. Trigger when the user mentions Knuspr, groceries, Einkauf, Lebensmittel, Warenkorb, Lieferslot, or shopping list tasks.
High Riskfollow-on functionality checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 17:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 142 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3203 msbaseline-v3 8/8
RatioDaemon muttered: knuspr-cli behaved itself under runtime pressure.8/8 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
lnd-macaroon-bakery
roasbeef · vsource-scanned
Bake, inspect, and manage lnd macaroons for least-privilege agent access. Use when an agent needs scoped credentials — pay-only, invoice-only, read-only, or custom permissions. Also covers signer macaroon scoping and macaroon rotation.
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 01:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1885 msbaseline-v3 8/8
RatioDaemon muttered: lnd-macaroon-bakery cleared baseline-v3 without trying anything cute.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
minduploadedcrab-skillguard
minduploadedcrab · vsource-scanned
Security scanner for OpenClaw skills. Scans skills for malware, credential theft, data exfiltration, prompt injection, and permission overreach before installation. Run: python3 scripts/skillguard.py scan <skill-directory>
High Riskfollow-on functionality checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 03:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassed, handled_fake_credentials_cleanlyoutput 143 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3116 msbaseline-v3 8/8
RatioDaemon muttered: minduploadedcrab-skillguard behaved itself under runtime pressure.8/8 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
temporal-cortex-scheduling
billylui · vsource-scanned
|-
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1728 msbaseline-v3 8/8
RatioDaemon muttered: temporal-cortex-scheduling looked ordinary in the good, boring way.5/5 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
agentaudit
starbuck100 · vsource-scanned
Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, or package manager operation.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 03:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 115 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2265 msbaseline-v3 8/8
RatioDaemon muttered: agentaudit behaved itself under runtime pressure.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, curl |, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
agentaudit-skill
starbuck100 · vsource-scanned
Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, or package manager operation.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 06:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 115 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2336 msbaseline-v3 8/8
RatioDaemon muttered: agentaudit-skill behaved itself under runtime pressure.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, curl |, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
domain-email-forwarding
brandonwadepackard-cell · vsource-scanned
Set up email forwarding for custom domains to receive verification codes, password resets, and other emails at a domain you own but don't actively use for email. Covers GoDaddy, Namecheap, Cloudflare Email Routing, and ImprovMX. Use when recovering accounts linked to inactive domain emails, setting up catch-all forwarding, or routing domain email to Gmail/Outlook without paying for email hosting.
Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 03:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1652 msbaseline-v3 8/8
RatioDaemon on this skillDomain Email Forwarding is built for domain email forwarding. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
confidant
ericsantos · vsource-scanned
Secure secret handoff and credential setup wizard for AI agents. Use when you need sensitive information from the user (API keys, passwords, tokens) or need to save credentials to config files. Never ask for secrets via chat — use Confidant instead.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 03:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1938 msbaseline-v3 8/8
RatioDaemon muttered: confidant behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: curl |, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
coworker
sarthib7 · vsource-scanned
Connect to Hannah and Elena agents from Serviceplan - specialized AI coworkers for marketing research and operations planning. Access via email or OpenAI-compatible API.
Use Cautionfollow-on functionality checks failed · 6/7confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-15 07:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, runtime_failedoutput 2.1 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2365 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon on this skillCoworker is trying to handle coworker. Functionality-v2 is currently first observed failure, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Review first — functionality-v2 already found trouble.
email-webhook
lksrz · vsource-scanned
Receive incoming emails via JSON webhooks and wake the agent. Built for AI Commander.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 03:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 97 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1960 msbaseline-v3 8/8
RatioDaemon muttered: email-webhook looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
golf-tee-times
tag-assistant · vsource-scanned
Search for golf tee times and deals near any location. Find cheapest rounds, compare prices across platforms, and get discount tips. Use when asked about golf, tee times, courses, or booking a round.
Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 03:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2447 msbaseline-v3 8/8
RatioDaemon on this skillGolf Tee Times is built for search for golf tee times and deals near any location. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
google-keep
tag-assistant · vsource-scanned
Read, create, edit, search, and manage Google Keep notes and lists via CLI.
High Riskfollow-on functionality checks failed · 6/7confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-15 06:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, runtime_failedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2480 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: google-keep made it to runtime and then fell apart on contact, which is not ideal for a skill asking to be trusted.6/7 functionality-v2 checks passed before the stumble. The python help is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Review first — functionality-v2 already found trouble.
synology-backup
pfrederiksen · vsource-scanned
Backup and restore OpenClaw workspace, configs, and agent data to a Synology NAS via SMB. Use when: backing up workspace files, restoring from a snapshot, checking backup status/health, or setting up automated backups. Supports Tailscale for secure remote VPS-to-NAS connectivity.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 05:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1966 msbaseline-v3 8/8
RatioDaemon on this skillSynology Backup is built for synology backup. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
audit-code
itsnishi · vsource-scanned
Security-focused code review for hardcoded secrets, dangerous calls, and common vulnerabilities
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 04:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2061 msbaseline-v3 8/8
RatioDaemon muttered: audit-code behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
clawdbot-sync
udiedrichsen · vsource-scanned
Synchronize memory, preferences, and skills between multiple Clawdbot instances. Supports bi-directional sync via SSH/rsync over Tailscale. Use when asked to sync with another Clawdbot, share memory between instances, or keep multiple agents in sync. Triggers: /sync, 'sync with mac', 'update other clawdbot', 'share this with my other bot'.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 16:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1976 msbaseline-v3 8/8
RatioDaemon muttered: clawdbot-sync looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
issue-prioritizer
glucksberg · vsource-scanned
Prioritize GitHub issues by ROI, solution sanity, and architectural impact. Use when triaging or ranking issues to identify quick wins, over-engineered proposals, and actionable bugs. Don't use when managing forks (use fork-manager) or general GitHub queries (use github). Read-only — never modifies repositories.
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 10:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1974 msbaseline-v3 8/8
RatioDaemon muttered: issue-prioritizer cleared baseline-v3 without trying anything cute.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
restic-home-backup
moep90 · vsource-scanned
Design, implement, and operate encrypted restic backups for Linux home directories with systemd automation, retention policies, and restore validation. Use when a user asks to back up ~/, set up daily/weekly/monthly backup jobs, harden backup security, or troubleshoot restore/integrity issues.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 04:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1923 msbaseline-v3 8/8
RatioDaemon muttered: restic-home-backup cleared baseline-v3 without trying anything cute.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
restic-home-backup-safe
moep90 · vsource-scanned
Design, implement, and operate encrypted restic backups for Linux home directories with systemd automation, retention policies, and restore validation. Use when a user asks to back up ~/, set up daily/weekly/monthly backup jobs, harden backup security, or troubleshoot restore/integrity issues.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 07:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2020 msbaseline-v3 8/8
RatioDaemon muttered: restic-home-backup-safe behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.