D
DriftLoom.ai
Trust index first • editorial second
🧪 runtime dashboard live
☰ Menu
🔎 Evidence browser

Browse the trust index

Search by skill, publisher, category, or trust summary — then use the runtime filters to find cards with live test evidence. The two main lanes are baseline safety checks first and deeper follow-on functionality checks after that.

⚙️ Filters
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds review
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180
✨ Quick picks
SecurityGitHubWeatherTrusted with current evidenceHigher-confidence picksTrusted + tested + source-scannedReview before installingRuntime-testedHandled fake credentials cleanlyNeeds real credentials / accessCould not fully test yetFresh runtime evidenceOlder runtime evidenceHall of ShameStronger evidence importsNeeds review
🏷 Categories
All categoriesawesome-index · 5367catalog-only · 5367coding-agents-and-ides · 1200web-and-frontend-development · 924devops-and-cloud · 392search-and-research · 352browser-and-automation · 320productivity-and-tasks · 204ai-and-llms · 184cli-utilities · 180

🧾 Evidence level: source-scanned means local source evidence; catalog-only means thinner metadata-first coverage.

🧪 Runtime status: cards can show only the baseline safety lane or the deeper follow-on functionality lane, depending on how far the skill got. Some cards now also surface how the skill behaved when clearly fake credentials were present.

📏 Depth cue: tells you whether the evidence stops at baseline checks, includes follow-on functionality checks, or includes richer fixture/example proof.

⏱ Freshness cue: tells you whether the latest runtime evidence is from the last 24 hours, the last 7 days, or is older and therefore less current.

🩺 Failure confidence: distinguishes a first seen failure from a repeated failure or a regression after an earlier pass, so not every red row means the same thing.

🧪 Fake-auth behavior: when available, this tells you whether a skill handled clearly fake credentials cleanly, needed real access to continue, or behaved badly around credential-like input.

Results

Showing 24 of 5419 skills in the browsable catalog view · sort: score
page evidence snapshotruntime-passed: 4runtime-failed: 0source-scanned: 24fresh <24h: 0manual review: 0
This snapshot is for the current page of results, not the whole filtered universe.
Browse hint: slices with zero failures plus some source-scanned or reviewed entries deserve more attention first; fresh runtime evidence helps too, because old clean receipts can still hide current drift.
Quick guide for newcomers: start by scanning the card badges for runtime passed, source-scanned, and fresh evidence. Then use the decision cue on each card to sort “good first pick” from “needs review” without opening every result.

open-lesson

dncolomer · vsource-scanned
47
overall

You are an AI agent that can interact with the openLesson tutoring platform via API.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

open-stellar

sixela33 · vsource-scanned
47
overall

Interact with the Stellar blockchain — manage keys, networks, and smart contracts using the Stellar CLI.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (wallet), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

ordercli

OpenClaw · vbundled
47
overall

Foodora-only CLI for checking past orders and active order status (Deliveroo WIP).

High Riskconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

orgo-desktop-control

cohenyehonatan · vsource-scanned
47
overall

Provision and control Orgo cloud computers using the orgo_client Python SDK. Use when launching remote desktops, automating browsers, running bash/python remotely, interacting with UI, managing files, or controlling streaming.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

paper-evoweb-ai

galizki · vsource-scanned
47
overall

Generate publication-ready scientific articles in PDF format with AI-powered research and citations

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

pc-master

amirgu · vsource-scanned
47
overall

Control the Windows PC from WSL2. Use when the user asks to open/close applications, manage processes, take screenshots, control windows, manage files on Windows (C:\), automate tasks, or do anything that requires interacting with the Windows host from WSL2 (e.g. "open Chrome", "kill Spotify", "take a screenshot", "list running apps", "move a file on Windows").

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram, whatsapp), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

perplexity-wrapped

vacinc · vsource-scanned
47
overall

Search the web with AI-powered answers via Perplexity API. Supports three modes - Search API (ranked results), Sonar API (AI answers with citations, default), and Agentic Research API (third-party models with tools). All responses wrapped in untrusted-content boundaries for security.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

porteden

porteden · vsource-scanned
47
overall

Secured Calendar and Email management - Gmail, Outlook & Exchange - list, search, create, update, delete calendar events and list, search, read, send, reply, forward, delete, modify emails across multiple accounts (gog-cli secure alternative).

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, gmail, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

publish-guard

edmonddantesj · vsource-scanned
47
overall

<!-- 🌌 Aoineco-Verified | S-DNA: AOI-2026-0213-SDNA-PG01 -->

High Riskfollow-on functionality checks passed · 6/6confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 18:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2047 msbaseline-v3 8/8
RatioDaemon on this skillPublish Guard is built for publish guardrails. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

qr-gen

claudiodrusus · vsource-scanned
47
overall

Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, generate WiFi login QR codes, create contact/vCard QR codes, or produce any scannable barcode image. Outputs PNG, SVG, or ASCII art.

Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 01:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2416 msbaseline-v3 8/8
RatioDaemon muttered: qr-gen cleared the baseline safety checks without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

qrcode

hexavi8 · vsource-scanned
47
overall

Generate styled QR codes (SVG/PNG/JPG) with custom colors, shapes, and error correction. Agent should display generated files. Secure: all outputs saved to workspace root.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

qrdex

sebastienb · vsource-scanned
47
overall

Create, manage, and track QR codes using the QRdex.io REST API. Use when working with QR code generation, URL shortening with QR codes, WiFi QR codes, email/SMS/WhatsApp QR codes, scan tracking, or any QRdex.io operations. Supports all QR types (url, email, telephone, sms, whatsapp, wifi) with customizable colors and shapes.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

revolut

odrobnik · vsource-scanned
47
overall

Revolut web automation via Playwright: login/logout, list accounts, and fetch transactions.

High Riskfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 07:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2540 msbaseline-v3 8/8
RatioDaemon on this skillRevolut looks aimed at revolut. Follow-on functionality checks currently pass without failed checks, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

secret-manager

jswortz · vsource-scanned
47
overall

Manage API keys securely via GNOME Keyring and inject them into OpenClaw config.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: sudo .
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

self-evolve

be1human · vsource-scanned
47
overall

>

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: rm -rf.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

self-integration

bratchenko · vsource-scanned
47
overall

Connect to any external app and perform actions on it. Use when the user wants to interact with external services like Slack, Linear, HubSpot, Salesforce, Jira, GitHub, Google Sheets, or any other app — send messages, create tasks, sync data, manage contacts, or perform any API operation.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

shieldcortex-skill

jarvis-drakon · vsource-scanned
47
overall

Give your AI agent a brain that persists between sessions — and protect it from memory poisoning attacks.

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (private key, token, oauth, email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

skill-1

claudiodrusus · vsource-scanned
47
overall

Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, generate WiFi login QR codes, create contact/vCard QR codes, or produce any scannable barcode image. Outputs PNG, SVG, or ASCII art.

Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence
+ 2 more
source-scannedsuspicious
What the test confirmed2026-03-14 04:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2383 msbaseline-v3 8/8
RatioDaemon muttered: skill-1 cleared the baseline safety checks without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

skill-5

diederik24 · vsource-scanned
47
overall

AI video production workflow using Remotion. Use when creating videos, short films, commercials, or motion graphics. Triggers on requests to make promotional videos, product demos, social media videos, animated explainers, or any programmatic video content. Produces polished motion graphics, not slideshows.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found normal operational surface via environment, network, or shell-related references.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

skill-review-registry

sebbysoup · vsource-scanned
47
overall

version: 1.0.0

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

skill-reviews

sebbysoup · vsource-scanned
47
overall

version: 1.0.0

Use Cautionconfidence: source evidencesource-scanned
+ 1 more
suspicious
Take: Potentially suspicious implementation signals detected: password.
Newcomer read: Proceed carefully — suspicious signals matter more than capability surface alone.

skill-soup

bennettphil · vsource-scanned
47
overall

Autonomous skill generation agent that picks up community ideas, uses evolved builder tools to produce Agent Skills, and publishes them back to the Skill Soup ecosystem. Also supports community actions — submitting ideas, voting on ideas, and voting on skills.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (token), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

smart-daily-assistant

mkpareek0315 · vsource-scanned
47
overall

When user asks to set reminders, save quick notes, get morning briefing, draft messages, use quick reply templates, translate text, plan day, schedule tasks, track habits, track birthdays, log expenses, save links, manage contacts, change message tone, plan weekend, or any daily personal assistant task. 20-feature AI personal assistant with reminders, notes, briefings, message drafting, quick replies, templates, translate, daily planner, habit tracker, and gamification. All data stays local — NO external API calls, NO network requests, NO data sent to any server.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (email), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.

smart-expense-tracker

mkpareek0315 · vsource-scanned
47
overall

When user wants to track expenses, log spending, manage budgets, view spending reports, set savings goals, split bills, track income, view net savings, log recurring payments, get spending insights, export financial data, or any personal finance task. 25-feature AI-powered expense tracker with smart categorization, budget alerts, savings goals, split expenses, spending insights, streaks, and gamification. Works via natural language — just type "spent 50 on food" and done. Free alternative to Mint, YNAB, PocketGuard. All data stays local.

Insufficient Evidenceconfidence: source evidencesource-scanned
+ 1 more
privileged capability
Take: Source-aware scan found higher-privilege capability areas (telegram), but that alone is not evidence of malicious behavior.
Newcomer read: Decent evidence base — source-level signals are available, so inspect the receipts.
« First← Prev1191192193226Page 192 / 226Next →Last »