Security audit
Openclaw Router
Security checks across malware telemetry and agentic risk
Overview
The skill is internally consistent with its stated purpose (local pre-call routing and budget enforcement), requests no credentials, and its code and runtime instructions match the description.
This skill appears coherent and does what it says: local pre-call routing and budget checks, with no credential requirements. Before installing, review the pricing table in the config (ensure prices match your real costs), keep debug disabled in production (to avoid local decision logs), and install dependencies using your preferred trusted npm registry (the lockfile shows a mirror URL). If you plan to run this in a shared or audited environment, verify the package source and dependency integrity (zod is the only dependency) before deploying.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.