D
DriftLoom.ai
Trust index first • editorial second
🧪 runtime dashboard live
☰ Menu
🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters · 1 active
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180
✨ Quick picks
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds reviewClear filters
🏷 Categories
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5418 skills in the browsable catalog view · reviewed: no · sort: score
page evidence snapshotruntime-passed: 1runtime-failed: 1source-scanned: 24fresh <24h: 0manual review: 0
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

documents-ai

dbirulia · vsource-scanned
47
overall

Real-time OCR and data extraction API by Veryfi (https://veryfi.com). Extract structured data from receipts, invoices, bank statements, W-9s, purchase orders, bills of lading, and any other document. Use when you need to OCR documents, extract fields, parse receipts/invoices, bank statements, classify documents, detect fraud, or get raw OCR text from any document.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

dsiprouter-skill

mackhendricks · vsource-scanned
47
overall

Call the dSIPRouter REST API using the Postman collection (curl + jq).

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo , password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

eachlabs-image-generation

eftalyurtseven · vsource-scanned
47
overall

Generate new images from text prompts using EachLabs AI models. Supports text-to-image with multiple model families including Flux, GPT Image, Gemini, Imagen, Seedream, and more. Use when the user wants to create new images from text. For editing existing images, see eachlabs-image-edit.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

expanso-email-triage

aronchick · vsource-scanned
47
overall

AI-powered email triage with calendar sync and response drafting

High Riskfollow-on functionality checks failed · 11/12confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test found2026-03-16 01:50 UTC
functionality-v2evidence depth: includes fixture-backed checkstested recently: within 7 daysfailure repeated in more than one runpassed, runtime failedoutput 9.2 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 3651 msbaseline-v3 8/8
🚫 skill exited with an error
RatioDaemon muttered: The runtime lane gave expanso-email-triage a chance to act normal. It declined and made it to runtime and then fell apart on contact.11/12 functionality-v2 checks passed before the stumble. The yaml parse is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Review first — functionality-v2 already found trouble.

external-ai-integration

konscious0beast · vsource-scanned
47
overall

Leverage external AI models (ChatGPT, Claude, Hugging Face, etc.) as tools via browser automation (Chrome Relay) and optional Hugging Face API. Use when you need to augment the assistant's capabilities with external LLMs for reasoning, summarization, code generation, or other tasks without spawning isolated sub‑agents.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

external-ki-integration-backup

konscious0beast · vsource-scanned
47
overall

Skill for accessing external AI services (ChatGPT, Claude, Hugging Face, etc.) via browser automation (Chrome Relay) and APIs to assist with tasks.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

founder-playbook

xeroc · vsource-scanned
47
overall

Decision validation and thinking frameworks for startup founders. Use when you need to pressure-test a decision, validate your next steps, think through strategic options, or sanity-check your approach. Triggers on phrases like "should I", "help me think through", "is this the right move", "validate my thinking", "what am I missing". Covers fundraising, customer development, runway management, prioritization, and crypto/web3 founder challenges.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, trading, token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

garmin-pulse

freakyflow · vsource-scanned
47
overall

Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data.

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

gekko

gekkoai001 · vsource-scanned
47
overall

version: 1.0.0

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet, trading, private key, token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

get-hba

matbalez · vsource-scanned
47
overall

Agent-first service to register and manage Human Bitcoin Addresses (BIP-353) on clank.money with L402 bitcoin payments.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

gifhorse

coyote-git · vsource-scanned
47
overall

Search video dialogue and create reaction GIFs with timed subtitles. Perfect for creating meme-worthy clips from movies and TV shows.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

gitmap

14-tr · vsource-scanned
47
overall

Version control for ArcGIS web maps — exposed as native OpenClaw tools.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

harpa-ai

alxsharuk · vsource-scanned
47
overall

user-invocable: true

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

here-now

adamludwin · vsource-scanned
47
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

heygen-avatar-lite

daaab · vsource-scanned
47
overall

Create AI digital human videos with HeyGen API. Free starter guide.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

hide-my-email

manikal · vsource-scanned
47
overall

Generate Apple Hide My Email addresses from the terminal and copy to clipboard.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

hitl-protocol

rotorstar · vsource-scanned
47
overall

HITL Protocol — the open standard for human decisions in autonomous agent workflows. When a website or API needs human input, it returns HTTP 202 with a review URL. Autonomous agents like OpenClaw, Claude, Codex, or Goose forward the URL, poll for the structured result, and continue. Use this skill to make any website agent-ready, or to handle human-in-the-loop responses in your agent. Covers approval, selection, input forms, confirmation, and escalation review types. Supports polling, SSE, webhook transports, channel-native inline buttons (Telegram, Slack, Discord, WhatsApp, Teams), opaque token security, multi-step form wizards, and multi-round edit cycles.

High Riskfollow-on functionality checks passed · 5/5confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-16 21:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1728 msbaseline-v3 8/8
RatioDaemon muttered: hitl-protocol behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

honcho-setup

ajspig · vsource-scanned
47
overall

>

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

hostinger

rexlunae · vsource-scanned
47
overall

Manage Hostinger account via API — VPS administration (start/stop/restart, snapshots, backups, firewall, Docker), DNS zone management, domain portfolio, website hosting, and billing. Use when asked to deploy, publish, manage servers, configure DNS, or control any Hostinger service.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

icloud-caldav

samuelhe52 · vsource-scanned
47
overall

Direct iCloud Calendar integration via CalDAV protocol. Create, read, update, and delete calendar events without third-party services. Use when the user wants to manage their iCloud Calendar, check schedule, create events, or find free time. Requires Apple ID and app-specific password.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

idrac

eddygk · vsource-scanned
47
overall

|

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

instagram-poster

al1enjesus · vsource-scanned
47
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

ios-simulator

tristanmanchester · vsource-scanned
47
overall

Automate iOS Simulator workflows (simctl + idb): create/boot/erase devices, install/launch apps, push notifications, privacy grants, screenshots, and accessibility-based UI navigation. Use when working with iOS apps, Xcode, Simulator, simctl, idb, UI automation, or iOS testing.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

job-hunt-tracker

mkpareek0315 · vsource-scanned
47
overall

When user asks to track job applications, manage job search, log interview, applied for job, job application status, track where I applied, job search organizer, application follow up, offer comparison, job pipeline, application stats, track rejection, track offer, job board, career tracker, job search progress, or any job hunting task. 20-feature AI job hunt tracker with application pipeline, interview scheduler, offer comparator, follow-up reminders, rejection analyzer, and job search gamification. Replaces $40/month job tracking tools for free. All data stays local — NO external API calls, NO network requests, NO data sent to any server.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.
« First← Prev1189190191226Page 190 / 226Next →Last »