🔎 Evidence browser

Browse the skill radar

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

✨ Quick picks

Security GitHub Weather Trusted only Higher-confidence picks Lower-friction local candidates Review-first installs Sandbox-tested Fresh runtime Stale runtime Hall of Shame Stronger evidence imports Needs review Clear filters

🏷 Categories

All categories awesome-index · 5367 catalog-only · 5367 coding-agents-and-ides · 1200 web-and-frontend-development · 924 devops-and-cloud · 392 search-and-research · 352 browser-and-automation · 320 productivity-and-tasks · 204 ai-and-llms · 184 cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

Results

Showing 23 of 119 skills in the browsable catalog view · runtime: tested · freshness: fresh · sort: score

page evidence snapshotruntime-passed: 22 runtime-failed: 1 source-scanned: 23 fresh <24h: 17 manual review: 0

This snapshot is for the current page of results, not the whole filtered universe.

Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.

crypto-hackathon

swairshah · vsource-scanned

Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 17:00 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2532 ms

RatioDaemon muttered: crypto-hackathon looked ordinary in the good, boring way.8/8 baseline-v3 checks passed. Pleasantly boring.

Observed: 5 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

hackathon

swairshah · vsource-scanned

Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 11:30 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2340 ms

RatioDaemon on this skillHackathon is built for hackathon. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 5 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

safe-backup

hacksing · vsource-scanned

Backup OpenClaw state directory and workspace with security best practices.

High Riskfollow-on functionality checks failed · 5/6confidence: source evidence

Runtime receipts + what failed2026-03-15 16:15 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hoursfirst failed run seen for this lanepassed, runtime_failedoutput 227 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1976 msbaseline-v3 8/8

🕵️ expected proof signal was missing🚫 skill exited with an error

RatioDaemon muttered: The runtime lane gave safe-backup a chance to act normal. It declined and made it to runtime and then fell apart on contact.5/6 functionality-v2 checks passed before the stumble. The shell syntax is the part that made this interesting.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: rm -rf, password.

Decision cue: Review first — functionality-v2 already found trouble.

sample-skill

swairshah · vsource-scanned

Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 22:30 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2394 ms

RatioDaemon muttered: sample-skill behaved itself under runtime pressure.8/8 baseline-v3 checks passed. Pleasantly boring.

Observed: 5 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

usdc

swairshah · vsource-scanned

Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 14:15 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2392 ms

RatioDaemon on this skillUsdc looks aimed at usdc. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 5 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

usdc-hackathon

swairshah · vsource-scanned

Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 19:45 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2330 ms

RatioDaemon muttered: usdc-hackathon behaved itself under runtime pressure.8/8 baseline-v3 checks passed. Pleasantly boring.

Observed: 5 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

botpress-adk

yueranlu · vsource-scanned

A guide to build AI bots with Botpress's Agent Development Kit (ADK)

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 01:50 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1623 msbaseline-v3 8/8

RatioDaemon muttered: botpress-adk behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Source-aware scan found higher-privilege capability areas (token, whatsapp, email), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

caldav-cli

cyberash-dev · vsource-scanned

Manage CalDAV calendars (iCloud, Google, Yandex) from the command line. Supports OAuth2 and Basic auth, multi-account, table/JSON output.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 11:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1653 msbaseline-v3 8/8

RatioDaemon on this skillCaldav Cli looks aimed at manage CalDAV calendars (iCloud, Google, Yandex) from the command line. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

lightning-agent-commerce

roasbeef · vsource-scanned

End-to-end agentic commerce workflow using Lightning Network. Use when an agent needs to set up a full payment stack (lnd + lnget + aperture), buy or sell data via L402, or enable agent-to-agent micropayments.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 08:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1637 msbaseline-v3 8/8

RatioDaemon on this skillLightning Agent Commerce is built for end-to-end agentic commerce workflow using Lightning Network. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

skill-father

moodykong · vsource-scanned

Authoritative skill-creation standards (Boss). Use when creating or updating OpenClaw skills so they are portable, reproducible, include prerequisites checks, and have a guided installation/onboarding flow that persists machine-specific config in skill-local config files.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 07:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1655 msbaseline-v3 8/8

RatioDaemon on this skillSkill Father looks aimed at authoritative skill-creation standards (Boss). Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

google-docs-skill

zagran · vsource-scanned

Direct access to the Google Docs API using OAuth 2.0. Create documents, insert and format text, and manage document content.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-16 01:50 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1654 msbaseline-v3 8/8

RatioDaemon muttered: google-docs-skill looked ordinary in the good, boring way.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.

Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.

secretcodex

akhmittra · vsource-scanned

Generate creative code names and encode/decode secret messages using classic and sophisticated ciphers. Blends nostalgic decoder ring fun with modern cryptographic techniques. Includes Caesar, Vigenère, Polybius, Rail Fence, and hybrid methods. Provides keys for secure message sharing between trusted parties.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 04:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1618 msbaseline-v3 8/8

RatioDaemon on this skillSecretcodex is trying to handle secretcodex. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

ctf-writeup-generator

akhmittra · vsource-scanned

Automatically generate professional CTF writeups from solving sessions with flag detection, challenge categorization, and proper markdown formatting

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 06:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1700 msbaseline-v3 8/8

RatioDaemon on this skillCtf Writeup Generator looks aimed at ctf writeup generation. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

dub-links-api

ferminrp · vsource-scanned

>

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 04:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1688 msbaseline-v3 8/8

RatioDaemon on this skillDub Links Api is built for dub links api. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

api-security

brandonwise · vsource-scanned

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 02:00 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1649 msbaseline-v3 8/8

RatioDaemon on this skillApi Security is built for api security. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

clawdbot-security-check

thesethrose · vsource-scanned

Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence

Runtime receipts + what passed2026-03-15 05:15 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 102 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1888 msbaseline-v3 8/8

RatioDaemon muttered: clawdbot-security-check cleared baseline-v3 without trying anything cute.6/6 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: curl |, rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

curl-http

arnarsson · vsource-scanned

Essential curl commands for HTTP requests, API testing, and file transfers.

Use Cautionfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 12:15 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1694 msbaseline-v3 8/8

RatioDaemon muttered: curl-http behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

wp-to-static

abhibavishi · vsource-scanned

Convert a WordPress website to a static site and deploy to Cloudflare Pages. Mirrors the rendered HTML via SSH, extracts only referenced assets (shrinks 1.5GB+ to ~25MB), fixes URLs, self-hosts fonts, strips WordPress cruft, and deploys. Use when migrating a WordPress site to static hosting.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence

Runtime receipts + what passed2026-03-15 16:45 UTC

functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1662 msbaseline-v3 8/8

RatioDaemon muttered: wp-to-static behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: rm -rf.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

homebrew

thesethrose · vsource-scanned

Homebrew package manager for macOS. Search, install, manage, and troubleshoot packages and casks.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 08:00 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 24 hourspassedoutput 245 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2299 ms

RatioDaemon on this skillHomebrew looks aimed at homebrew package manager for macOS. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 2 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

intercom-v002

tracsystems · vsource-scanned

Skill for autonomous agents. Secure & private P2P messaging (sidechannels), sparse state/data + contracts, and optional value transfer. For a true agentic internet.

High Riskbaseline safety checks passed · 8/8confidence: source evidence

Runtime receipts + what passed2026-03-15 00:15 UTC

baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 245 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2351 ms

RatioDaemon on this skillIntercom V002 is trying to handle skill for autonomous agents. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: 2 /workspace/source-files.txt

Take: Potentially suspicious implementation signals detected: rm -rf, sudo .

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

client-communication-engine

satoshistackalotto · vsource-scanned

Greek-language client correspondence — submission confirmations, summaries, document requests, reminders. Human review required before sending.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence

Runtime receipts + what passed2026-03-15 06:30 UTC

functionality-v2evidence depth: includes fixture-backed checkstested recently: within 24 hourspassedoutput 102 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1973 msbaseline-v3 8/8

RatioDaemon on this skillClient Communication Engine looks aimed at client communication engine. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: curl |, sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

greek-compliance-aade

satoshistackalotto · vsource-scanned

Greek tax compliance with AADE/TAXIS integration — VAT, payroll, EFKA, municipal taxes, stamp duty. Human confirmation for all submissions.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence

Runtime receipts + what passed2026-03-15 03:00 UTC

functionality-v2evidence depth: includes fixture-backed checkstested recently: within 7 dayspassedoutput 102 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1952 msbaseline-v3 8/8

RatioDaemon on this skillGreek Compliance Aade is trying to handle greek compliance aade. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: curl |, sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

greek-email-processor

satoshistackalotto · vsource-scanned

Email processing for Greek accounting. Connects via IMAP to scan for financial documents, AADE notices, and invoices. Routes to local pipelines.

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence

Runtime receipts + what passed2026-03-15 11:30 UTC

functionality-v2evidence depth: includes fixture-backed checkstested recently: within 24 hourspassedoutput 102 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1921 msbaseline-v3 8/8

RatioDaemon on this skillGreek Email Processor is trying to handle email processing for Greek accounting. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.

Observed: skill-structure-ok

Take: Potentially suspicious implementation signals detected: curl |, sudo , password.

Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.

« First ← Prev 1 4 5Page 5 / 5