Model Router

• Analyzed: May 14, 2026, 3:03 AM
• Findings: 1
• Version: 1.1.0
• Hash: 195be781b32a4d369de8a75efd9ac2dd8e08adb51a8acef90be53d6d0fc90b96
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its inherent high-risk capability of collecting and locally storing sensitive API keys for multiple AI providers (e.g., Anthropic, OpenAI, Gemini). While the `scripts/setup-wizard.py` script implements security best practices like using `getpass` for input and setting restrictive file permissions (0o600) on the `~/.model-router/.api-keys` file, the handling of such credentials always presents a significant risk. There is no clear evidence of intentional malicious behavior like exfiltration or unauthorized execution within the provided code or documentation, but the presence of this sensitive capability without explicit API call logic to external endpoints in the provided files, makes it a 'risky capability without clear malicious intent'.