node-red-manager
1999azzar · vsource-scanned
Manage Node-RED instances via Admin API or CLI. Automate flow deployment, install nodes, and troubleshoot issues. Use when user wants to "build automation", "connect devices", or "fix node-red".
Use Cautionfollow-on functionality checks failed · 6/8confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-14 06:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 daysfirst failed run seen for this lanepassed, expectation_failed, runtime_failedoutput 99 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2838 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: node-red-manager talked a big game, then missed its own proof signal, which is not ideal for a skill asking to be trusted.6/8 functionality-v2 checks passed before the stumble. The requirements txt shape is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Review first — functionality-v2 already found trouble.
slv-grpc-geyser
poppin-fumi · vsource-scanned
Ansible playbooks and Jinja2 templates for deploying and managing Solana gRPC Geyser streaming nodes.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 05:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 916 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2361 msbaseline-v3 8/8
RatioDaemon muttered: slv-grpc-geyser looked ordinary in the good, boring way.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
slv-rpc
poppin-fumi · vsource-scanned
Ansible playbooks and Jinja2 templates for deploying and managing Solana RPC nodes (mainnet, testnet, devnet).
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 02:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 1.2 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2249 msbaseline-v3 8/8
RatioDaemon muttered: slv-rpc cleared baseline-v3 without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
slv-validator
poppin-fumi · vsource-scanned
Ansible playbooks and Jinja2 templates for deploying and managing Solana validators (mainnet and testnet).
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 00:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 1.6 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2199 msbaseline-v3 8/8
RatioDaemon muttered: slv-validator looked ordinary in the good, boring way.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo .
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
ssh-op
moodykong · vsource-scanned
Use the ssh-op helper script to load an SSH private key from 1Password (op) into an in-memory ssh-agent and then run ssh. Use when connecting to hosts that require the 1Password-managed key, troubleshooting ssh-op, or onboarding a new machine by configuring the 1Password vault/item and adding SSH host aliases to ~/.ssh/config.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 02:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 117 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2428 msbaseline-v3 8/8
RatioDaemon on this skillSsh Op is built for ssh op. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
stripe-cli
kesslerio · vsource-scanned
A universal Moltbot skill wrapping Stripe CLI for payment processing, webhook testing, and API operations. Includes optional ShapeScale-specific extensions for clinic management.
High Riskfollow-on functionality checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 12:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 152 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2462 msbaseline-v3 8/8
RatioDaemon on this skillStripe Cli is built for stripe cli. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
tmx-cli
lars147 · vsource-scanned
Manage Thermomix/Cookidoo meal planning via tmx-cli. Use for recipe search, weekly meal plan management, shopping list generation, favorites, and recipe details. Trigger when the user mentions Cookidoo, Thermomix, Wochenplan, meal plan, Rezept, recipe, or Einkaufsliste for cooking.
High Riskfollow-on functionality checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 14:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 142 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3041 msbaseline-v3 8/8
RatioDaemon muttered: tmx-cli looked ordinary in the good, boring way.8/8 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
yacy
qsmtco · vsource-scanned
Control and manage a local YaCy search engine instance.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 12:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 120 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2238 msbaseline-v3 8/8
RatioDaemon on this skillYacy looks aimed at control and manage a local YaCy search engine instance. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
zapier-mcp
maverick-software · vsource-scanned
Connect 8,000+ apps via Zapier MCP. Includes full UI integration for Clawdbot Gateway dashboard. Use when setting up Zapier integration, connecting apps, or using Zapier tools via mcporter.
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 04:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1637 msbaseline-v3 8/8
RatioDaemon on this skillZapier Mcp sits in the zapier mcp lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
auto-research
yoder-bawt · vsource-scanned
An autonomous research agent for OpenClaw that searches, synthesizes, and stores findings with full source tracking.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 19:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 120 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2160 msbaseline-v3 8/8
RatioDaemon on this skillAuto Research looks aimed at auto research. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
deai-image
swaylq · vsource-scanned
Detect and remove AI fingerprints from AI-generated images. Strip metadata, add film grain, recompress, and bypass AI image detectors. Works with Midjourney, DALL-E, Stable Diffusion, Flux output.
High Riskfollow-on functionality checks failed · 9/10confidence: source evidence+ 2 more
Runtime receipts + what failed2026-03-15 15:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hoursfirst failed run seen for this lanepassed, runtime_failedoutput 171 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3499 msbaseline-v3 8/8
🕵️ expected proof signal was missing🚫 skill exited with an error
RatioDaemon muttered: deai-image made it to runtime and then fell apart on contact.9/10 functionality-v2 checks passed before the stumble. The python help is the part that made this interesting.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, sudo .
Decision cue: Review first — functionality-v2 already found trouble.
guard-scanner
koatora20 · vsource-scanned
Security scanner and runtime guard for AI agent skills. 358 static threat patterns across 35 categories + 27 runtime checks (5 defense layers). Use when scanning skill directories for security threats, auditing npm/GitHub/ClawHub assets for leaked credentials, running real-time file watch during development, integrating security checks into CI/CD pipelines (SARIF/JSON), setting up MCP server for editor-integrated scanning (Cursor, Windsurf, Claude Code, OpenClaw), or runtime guarding tool calls via the OpenClaw v2026.3.8 before_tool_call hook. Single dependency (ws). MIT licensed.
High Riskfollow-on functionality checks passed · 10/10confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 12:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 195 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3668 msbaseline-v3 8/8
RatioDaemon on this skillGuard Scanner is built for security scanner and runtime guard for AI agent skills. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: eval(, rm -rf, sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
lb-bmad-skill
leonaaardob · vsource-scanned
Use BMad (Breakthrough Method of Agile AI Driven Development) framework for AI-driven development. Use for: architecture analysis, sprint planning, story generation, PRD creation, and full development workflows. Requires coding-agent skill with Claude Code.
High Riskfollow-on functionality checks passed · 5/5confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 20:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 80 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1612 msbaseline-v3 8/8
RatioDaemon on this skillLb Bmad Skill looks aimed at lb bmad. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
rhandus-alerting-system
rhanxerox · vsource-scanned
Centralized alerting and notification system for OpenClaw. Multi-channel alerts, intelligent rules, escalation, and audit.
High Riskfollow-on functionality checks passed · 11/11confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 01:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassed, handled_fake_credentials_cleanlyoutput 209 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 3463 msbaseline-v3 8/8
RatioDaemon muttered: rhandus-alerting-system behaved itself under runtime pressure.11/11 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
security-guardian
1999azzar · vsource-scanned
Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase.
Use Cautionfollow-on functionality checks passed · 8/8confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 09:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 134 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2762 msbaseline-v3 8/8
RatioDaemon on this skillSecurity Guardian is trying to handle automated security auditing for OpenClaw projects. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
security-operator
kevjade · vsource-scanned
Runtime security guardrails for OpenClaw agents. Protects against prompt injection, excessive agency, cost runaway, credential leaks, and cascade effects. Includes a setup wizard and periodic audits.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 02:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1967 msbaseline-v3 8/8
RatioDaemon muttered: security-operator looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
skill-store
yx2601816404-sys · vsource-scanned
Smart skill installation advisor for ClawHub. Searches for skills matching your needs, evaluates candidates on security (via skill-shield), code quality, and documentation, then produces a comparison report with a recommendation. Use when: looking for a skill to do something specific, comparing similar skills, or wanting a safety-checked recommendation before installing. Zero external dependencies.
High Riskfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-16 02:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2532 msbaseline-v3 8/8
RatioDaemon muttered: skill-store cleared baseline-v3 without trying anything cute.7/7 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
tf-plan-review
tkuehnl · vsource-scanned
>
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 01:00 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1960 msbaseline-v3 8/8
RatioDaemon on this skillTf Plan Review sits in the tf plan review lane. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
expanso-secrets-scan
aronchick · vsource-scanned
Detect hardcoded secrets (API keys, tokens, passwords) in text or code
Use Cautionfollow-on functionality checks passed · 10/10confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 04:00 UTC
functionality-v2evidence depth: includes fixture-backed checkstested recently: within 7 dayspassedoutput 7.3 KBartifacts 0worker oc-sandboxsource stage: cache hitsuite 2996 msbaseline-v3 8/8
RatioDaemon muttered: expanso-secrets-scan looked ordinary in the good, boring way.10/10 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
key-expiry-tracker
tradmangh · vsource-scanned
Track **only expiry dates** (metadata) for API keys/client secrets/certificates and alert before they expire.
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-14 19:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1946 msbaseline-v3 8/8
RatioDaemon on this skillKey Expiry Tracker is trying to handle key expiry tracker. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
agent-safety
compass-soul · vsource-scanned
Outbound safety for autonomous AI agents — scans YOUR output before it leaves the machine. Git pre-commit hooks that automatically block commits containing API keys, tokens, PII, or secrets. Unlike inbound scanners (Skillvet, IronClaw), this protects against what YOU accidentally publish. Use when committing to git repos, publishing to GitHub, or running periodic system health checks. Automated enforcement at the git level — not prompts.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2076 msbaseline-v3 8/8
RatioDaemon muttered: agent-safety behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf, password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
arccos-golf
pfrederiksen · vsource-scanned
Analyze Arccos Golf performance data including club distances, strokes gained metrics, scoring patterns, and round-by-round performance. Use when the user asks about golf statistics, club recommendations, performance trends, or wants detailed analysis from their Arccos Golf sensors.
Use Cautionfollow-on functionality checks passed · 7/7confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 02:45 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 116 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2479 msbaseline-v3 8/8
RatioDaemon on this skillArccos Golf is trying to handle arccos golf. Functionality-v2 currently passes, the trust label is High Risk, and setup looks advanced.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
auto-whisper-safe
neal-collab · vsource-scanned
RAM-safe voice transcription with auto-chunking — works on 16GB machines without crashes
Use Cautionfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 10:30 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 7 dayspassedoutput 98 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 1933 msbaseline-v3 8/8
RatioDaemon muttered: auto-whisper-safe behaved itself under runtime pressure.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: rm -rf.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.
calibre-metadata-apply
nextaltair · vsource-scanned
Apply metadata updates to existing Calibre books via calibredb over a Content server. Use for controlled metadata edits after target IDs are confirmed by a read-only lookup.
High Riskfollow-on functionality checks passed · 6/6confidence: source evidence+ 2 more
Runtime receipts + what passed2026-03-15 15:15 UTC
functionality-v2evidence depth: follow-on functionality checkstested recently: within 24 hourspassedoutput 97 Bartifacts 0worker oc-sandboxsource stage: cache hitsuite 2138 msbaseline-v3 8/8
RatioDaemon muttered: calibre-metadata-apply looked ordinary in the good, boring way.6/6 functionality-v2 checks passed. Pleasantly boring.
Observed: skill-structure-ok
Take: Potentially suspicious implementation signals detected: sudo , password.
Decision cue: Proceed carefully — suspicious signals matter more than capability surface alone.