Model Router
v0.1.0Intelligent cost-aware model routing that classifies task complexity and selects the optimal AI model. Automatically routes simple tasks to cheap models and...
⭐ 0· 616·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes model-tier classification and explicit provider model IDs and pricing, which aligns with a 'model router' purpose. However, the skill references multiple external providers and OpenRouter model IDs but declares no required credentials or primary credential—this is unexpected unless the platform itself supplies provider access. Also the registry metadata lists no source or homepage, reducing transparency.
Instruction Scope
Runtime instructions are narrowly focused on (1) classifying task complexity and (2) selecting a model tier before calling sessions_spawn / delegating to a sub-agent. The guidance does not (as provided) ask the agent to read unrelated files, harvest environment variables, or exfiltrate data outside model invocation. Rules and keyword-based heuristics are explicit rather than vague.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so it writes nothing to disk and has minimal installation risk.
Credentials
The instructions reference OpenRouter and many provider-specific model IDs and pricing, which in practice requires model-access credentials (API keys) or platform-managed provider access. Yet requires.env and primary credential are empty. That mismatch is concerning because it hides the true credential/permission model: either the platform already supplies credentials (acceptable) or the SKILL.md expects the agent to obtain/require keys but doesn't declare them (poor hygiene and a transparency gap).
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent or cross-skill config changes in the provided instructions. It can be invoked autonomously (platform default), which is normal — but combined with credential/coverage gaps this increases impact.
What to consider before installing
This skill appears to be what it claims — a classifier + router that chooses cheaper or more capable models — but there are a few things to check before installing:
- Provider access: The SKILL.md references OpenRouter and many provider model IDs, but the skill declares no required API keys. Confirm who supplies model credentials in your environment (the platform, the user, or the skill). If the platform will route model calls on your behalf, verify its access controls; if the skill expects your keys, ask the author to declare them explicitly.
- Source & transparency: There's no source repository or homepage listed. Prefer skills with auditable source code or at least a maintainer contact, especially for anything that will autonomously route requests across external models.
- Sensitive data routing: This router will send user tasks to external models. Consider restricting it or not using it for confidential or regulated data unless you know which provider and what policies apply. Cheap/free models may have different privacy/retention rules.
- Pricing accuracy & maintenance: Pricing and model availability change quickly. Treat the included pricing/model list as advisory and test in a safe environment; ask for a way to pin or update provider mappings.
- Test in non-production: Try it in a sandbox with low-risk workloads to confirm routing behavior, rate limits, and that the platform enforces provider credentials as you expect.
If you want a higher-confidence assessment, provide the full SKILL.md (untruncated), the platform's model-credential model (who holds API keys), or a source repo/homepage for the skill so we can inspect whether it ever reads environment variables or attempts to fetch external code.Like a lobster shell, security has layers — review code before you run it.
latestvk97a6seq403h70qad7t4f7ss01816k22
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
