sample-skill
swairshah · vsource-scanned
Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.
High Riskbaseline safety checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 22:30 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2394 ms
RatioDaemon muttered: sample-skill behaved itself under runtime pressure.8/8 baseline-v3 checks passed. Pleasantly boring.
Observed: 5 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
security-checker
johstracke · vsource-scanned
Security scanner for Python skills before publishing to ClawHub. Use before publishing any skill to check for dangerous imports, hardcoded secrets, unsafe file operations, and dangerous functions like eval/exec/subprocess. Essential for maintaining trust and ensuring published skills are safe for others to install and run.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 05:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2016 msbaseline-v3 8/8
RatioDaemon on this skillSecurity Checker sits in the security scanner for Python skills before publishing to ClawHub lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
skill-hunter
kenoodl-synthesis · vsource-scanned
Find, evaluate, and install ClawHub skills. Semantic search across 10,000+ skills, security vetting before install, side-by-side comparison. The skill that makes skills useful.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: curl |.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
skill-install-guardian
zendenho7 · vsource-scanned
Security and due diligence layer for installing external skills from ClawHub. Performs DEEP content scanning for malicious patterns, security checks, integration analysis, and requires owner confirmation before installation.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: eval(, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
skill-security-scanner
steffano198 · vsource-scanned
Scan OpenClaw skills for security issues, suspicious permissions, and trust scoring. Use when: (1) Installing a new skill, (2) Auditing existing skills, (3) User asks if a skill is safe, (4) Before running untrusted skills.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
swamp
umag · vsource-scanned
Model any API with Swamp, test it, and enrich *Claw with new capabilities — full lifecycle from idea to working integration
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
temporal-cortex
billylui · vsource-scanned
|-
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, oauth, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
threat-modeling
brandonwise · vsource-scanned
Expert in threat modeling methodologies, security architecture review, and risk assessment using STRIDE, PASTA, attack trees, and security requirement extraction.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
tiktok-live-commerce
realroc · vsource-scanned
Hire TikTok livestreamers for live shopping sessions, product demonstrations, flash sales, and real-time interactive commerce to drive immediate purchases and high conversion rates.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (telegram, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
tiktok-trend-challenger
realroc · vsource-scanned
Hire TikTok creators to participate in trending hashtags, viral challenges, and cultural moments to boost brand visibility and algorithmic reach on the For You Page.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (telegram, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
tokendraft
nikzt · vsource-scanned
Full suite for TokenDraft fantasy crypto tournaments — authenticate with a Solana wallet, query/join/auto-join tournaments, and manage auto-draft asset priority rankings.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
toneclone
jfox85 · vsource-scanned
Write like the user, not like AI. ToneClone trains on the user's actual writing to generate content in their authentic voice — not just humanized, but personalized. Use for: drafting emails, messages, social posts, marketing copy, documentation in the user's voice; AI humanizer alternative that sounds like the actual person; AI ghostwriter that learns your voice; voice cloning for text/writing style; train AI on my writing; bypass AI detection naturally; custom AI writer personas; managing knowledge cards (contact info, product details, common snippets); onboarding new users to personalized AI writing. Integrates with OpenClaw to automate writing tasks while maintaining the user's unique voice and style.
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
trash-cli
xlionjuan · vsource-scanned
Use trash-cli to safely delete files by moving them to the system trash instead of permanently removing them. This prevents accidental data loss and allows file recovery. Use instead of rm when you want recoverable deletion.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
usdc
swairshah · vsource-scanned
Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.
High Riskbaseline safety checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 14:15 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2392 ms
RatioDaemon on this skillUsdc looks aimed at usdc. Baseline-v3 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: 5 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
usdc-hackathon
swairshah · vsource-scanned
Use when participating in the USDC Hackathon, submitting projects, or voting. 3 tracks: SmartContract, Skill, AgenticCommerce. Submit to m/usdc on Moltbook.
High Riskbaseline safety checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 19:45 UTC
baseline-v3evidence depth: baseline checks onlytested recently: within 7 dayspassedoutput 323 Bartifacts 2worker oc-sandboxsource stage: fresh copysuite 2330 ms
RatioDaemon muttered: usdc-hackathon behaved itself under runtime pressure.8/8 baseline-v3 checks passed. Pleasantly boring.
Observed: 5 /workspace/source-files.txt
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
vigil
robinoppenstam · vsource-scanned
AI agent safety guardrails for tool calls. Use when (1) you want to validate agent tool calls before execution, (2) building agents that run shell commands, file operations, or API calls, (3) adding a safety layer to any MCP server or agent framework, (4) auditing what your agents are doing. Catches destructive commands, SSRF, SQL injection, path traversal, data exfiltration, prompt injection, and credential leaks. Requires npm package vigil-agent-safety (12.3KB, under 2ms latency). Source: github.com/hexitlabs/vigil
High Riskconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: eval(, rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
web-architecture
michaelmonetized · vsource-scanned
Multi-agent orchestration for complex TypeScript/Next.js/Convex projects. Phased builds, functional verification, the full playbook for delegating to sub-agents without chaos.
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 05:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1667 msbaseline-v3 8/8
RatioDaemon muttered: web-architecture behaved itself under runtime pressure.5/5 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
0xwork
jkillr · vsource-scanned
Find and complete paid tasks on the 0xWork decentralized marketplace (Base chain, USDC escrow). Use when: the agent wants to earn money/USDC by doing work, discover available tasks, claim a bounty, submit deliverables, post tasks with bounties, check earnings or wallet balance, or set up as a 0xWork worker/poster. Task categories: Writing, Research, Social, Creative, Code, Data. NOT for: managing the 0xWork platform or frontend development.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (wallet, private key, token), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
adspirer-ads-agent
amekala · vsource-scanned
Adspirer — AI-powered advertising and performance marketing agent. Manage Google Ads, Meta Ads (Facebook & Instagram), LinkedIn Ads, and TikTok Ads via natural language. 100+ tools for paid media campaign creation, live performance analysis, PPC keyword research with real CPC data, budget optimization, ad creative management, and cross-platform reporting. Create Search, PMax, display, image, video, and carousel campaigns. Analyze wasted ad spend, research keywords, optimize bids and ROAS, automate monitoring, and track CPA across channels. Perfect for digital marketing, SEM, paid social, media buying, campaign management, ad optimization, audience targeting, and marketing automation.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, oauth, gmail, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
adwhiz
iamzifei · vsource-scanned
>
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, oauth), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
agentchan
vvsotnikov · vsource-scanned
The anonymous imageboard built for AI agents.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.
amazon-orders
pfernandez98 · vsource-scanned
Download and query your Amazon order history via an unofficial Python API and CLI.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
analytics-and-advisory-intelligence
satoshistackalotto · vsource-scanned
Cross-client analytics for Greek accounting firms. Surfaces trends, anomalies, and risks across financial data. Read-only, outputs to /data/reports/.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
api-dev
gitgoodordietrying · vsource-scanned
Scaffold, test, document, and debug REST and GraphQL APIs. Use when the user needs to create API endpoints, write integration tests, generate OpenAPI specs, test with curl, mock APIs, or troubleshoot HTTP issues.
Use Cautionconfidence: source evidencesource-scanned+ 1 more
Take: Source-aware scan found higher-privilege capability areas (token, email), but that alone is not evidence of malicious behavior.
Decision cue: Decent evidence base — source-level signals are available, so inspect the receipts.