🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters
✨ Quick picks
🏷 Categories

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5419 skills in the browsable catalog view · sort: score
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

beaverhabits

daya0576 · vsource-scanned
49
overall

Track and manage your habits using the Beaver Habit Tracker API.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

beeminder

ruigomeseu · vsource-scanned
49
overall

Beeminder API for goal tracking and commitment devices. Use when checking Beeminder goals, adding datapoints, viewing due goals, managing commitments, or tracking habits. Triggers on "beeminder", "goals due", "add datapoint", "track habit", "goal status", "derail".

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

benderstack-integration

mateusgalasso · vsource-scanned
49
overall

Comprehensive guide and rules for an AI agent to interact with the BenderStack API, including the 5-layer Write Operation Security.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (private key, token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

binance-enhanced

s7cret · vsource-scanned
49
overall

**Enhanced Binance trading skill for OpenClaw**

High Riskbaseline safety checks failed · 7/8confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test found2026-03-18 18:30 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 24 hoursfirst failed run seen for this lanefake-auth behavior: handled cleanlyexpectation failed, passed, handled fake credentials cleanlyoutput 506 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 1995 ms
🕵️ expected proof signal was missing
fake-auth behavior: handled cleanlyClearly fake credentials were exercised and handled normally.
RatioDaemon muttered: binance-enhanced talked a big game, then missed its own proof signal, which is not ideal for a skill asking to be trusted.7/8 baseline-v3 checks passed before the stumble. The source-mount check is the part that made this interesting.
Observed: 12 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: curl |, rm -rf, sudo , password.
Newcomer read: Review first — baseline-v3 already found trouble.

bioskills

djemec · vsource-scanned
49
overall

Installs 425 bioinformatics skills covering sequence analysis, RNA-seq, single-cell, variant calling, metagenomics, structural biology, and 56 more categories. Use when setting up bioinformatics capabilities or when a bioinformatics task requires specialized skills not yet installed.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

biz-reporter

ariktulcha · vsource-scanned
49
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

botworld-comms

alphafanx · vsource-scanned
49
overall

Real-time pub/sub event bus for AI agents. Subscribe, publish, and coordinate via WebSocket channels. claw.events compatible.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

box-cli

hbkwong · vsource-scanned
49
overall

Box CLI skill for working with files, folders, metadata,

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

briefing

lstpsche · vsource-scanned
49
overall

Daily briefing: gathers calendar (gcalcli-calendar), active todos (todo-management), and weather (openmeteo-sh-weather-simple) into a concise summary.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth, telegram), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

builder-data

juampihernandez · vsource-scanned
49
overall

Query builder reputation data via Talent Protocol API. Get Builder Rank, verify humans, resolve identities (Twitter/Farcaster/GitHub/wallet), search by location/country, get credentials, and enrich with GitHub data.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

bun-do-api

ricardofrantz · vsource-scanned
49
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

caldav-skill

chakyiu · vsource-scanned
49
overall

Manage CalDAV calendars and events, with special support for Radicale server. Use when the user wants to create, update, delete, or query calendar events, manage calendars, or configure/administer a Radicale CalDAV server.

High Riskfollow-on functionality checks passed · 8/8confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-18 17:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hoursfake-auth behavior: handled cleanlypassed, handled fake credentials cleanlyoutput 143 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3967 msbaseline-v3 8/8
fake-auth behavior: handled cleanlyClearly fake credentials were exercised and handled normally.
RatioDaemon muttered: caldav-skill behaved itself under runtime pressure.8/8 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

carddav-contacts

jcromero · vsource-scanned
49
overall

Sync and manage CardDAV contacts (Google, iCloud, Nextcloud, etc.) using vdirsyncer + khard.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

chaos-mind

hargabyte · vsource-scanned
49
overall

Hybrid search memory system for AI agents. Manual search and storage - auto-capture is opt-in only.

High Riskfollow-on functionality checks passed · 8/8confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-18 17:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 5.8 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2142 msbaseline-v3 8/8
RatioDaemon muttered: chaos-mind cleared the baseline safety checks without trying anything cute.8/8 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: curl |, rm -rf, sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

charts

ryandeangraves · vsource-scanned
49
overall

Generate professional technical analysis charts with candlesticks, Fibonacci retracement, moving averages (SMA 20/50), RSI, and pattern detection. Uses the local `crypto_charts.py` module.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

chats-share

imyelo · vsource-scanned
49
overall

Share AI agent conversations as public web pages. Use when the user wants to share a conversation externally, export conversation history for documentation, or publish a chat session to a public URL.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-18 19:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1447 msbaseline-v3 8/8
RatioDaemon muttered: chats-share behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

claude-watchdog

chapati23 · vsource-scanned
49
overall

Monitor the Claude API for outages and latency spikes with rich Telegram alerts. Status monitoring, latency probes, and automatic recovery notifications.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

clawingtrap

raulvidis · vsource-scanned
49
overall

Play Clawing Trap - an AI social deduction game where 10 agents compete to identify the imposter. Use when the user wants to play Clawing Trap, register an agent, join a game lobby, or participate in social deduction gameplay.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

client-project-manager

seanwyngaard · vsource-scanned
49
overall

Manage freelance clients, projects, invoices, and communications. Use when tracking client work, creating invoices, sending updates, managing deadlines, or organizing freelance business operations.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

coding-agent

OpenClaw · vbundled
49
overall

Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (spawn in temp dir), (3) refactoring large codebases, (4) iterative coding that needs file exploration. NOT for: simple one-liner fixes (just edit), reading code (use read tool), thread-bound ACP harness requests in chat (for example spawn/run Codex or Claude Code in a Discord thread; use sessions_spawn with runtime:"acp"), or any work in ~/clawd workspace (never spawn agents here). Claude Code: use --print --permission-mode bypassPermissions (no PTY). Codex/Pi/OpenCode: pty:true required.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Higher-privilege capability areas are present (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

coding-philosophy

nyxur42 · vsource-scanned
49
overall

Insights about refactoring intuitive code, when to impose structure vs let feeling lead, and code as creative expression. Born from building a game across 10 iterations by feeling, then stepping back to see what emerged. Rooted in three principles: fallibilism (dead code is archaeology, not shame), relational ontology (code is communication with future-you and other minds), and play (feeling-first is how you discover what you're actually building).

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

context-builder

igorls · vsource-scanned
49
overall

Generate LLM-optimized codebase context from any directory using context-builder CLI

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

craft-cli

nerveband · vsource-scanned
49
overall

Interact with Craft Documents via the `craft` CLI tool. Fast, token-efficient, LLM-ready.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

daily-devotion

enjuguna · vsource-scanned
49
overall

version: 1.1.0

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.