ModelPool (Free)

ReviewAudited by ClawScan on May 10, 2026.

Overview

Review recommended: the skill mostly matches its model-management purpose, but its install instructions point outside the reviewed package while it also stores API keys and changes OpenClaw configuration.

Before installing, verify that the package or GitHub repo you install exactly matches this reviewed version. Expect your OpenRouter keys to be saved under ~/.openclaw and inserted into OpenClaw configuration. Back up your OpenClaw config, use revocable keys, and run the repair command only when a restart and session cleanup are acceptable.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user could install a package or repository whose contents do not match the scanned skill, then give that code API keys and permission to modify OpenClaw settings.

Why it was flagged

The README directs users to install external, unpinned code even though the registry has no install spec and the reviewed setup.py declares a different package name, modelpool-free. Users may run code that is not the same as the reviewed artifact.

Skill content
pip install modelpool-oc
...
git clone https://github.com/meilihulee/modelpool.git
Recommendation

Only install from a verified source that matches the reviewed files and version. The publisher should add a clear install spec, align the package names, and pin or document the trusted distribution source.

What this means

Anyone or any process with access to the user's OpenClaw config files could potentially use the stored OpenRouter keys and consume quota or account credit.

Why it was flagged

The skill saves OpenRouter API keys persistently and writes them into the OpenClaw provider configuration. This is expected for model routing, but it is sensitive credential handling.

Skill content
KEYS_PATH = os.path.expanduser("~/.openclaw/modelpool_keys.json")
...
json.dump(keys_data, f, indent=2)
...
"apiKey": key
Recommendation

Use keys you can revoke, avoid using keys with unnecessary paid access, protect the ~/.openclaw directory, and rotate the keys if the machine or files may be exposed.

What this means

Running repair may interrupt active OpenClaw work, change configuration, or clean session state.

Why it was flagged

The repair command runs several local commands that can modify OpenClaw configuration, clean sessions, and restart the daemon. These actions are disclosed and purpose-aligned, but they are bundled into one repair workflow.

Skill content
run("openclaw doctor --fix")
...
run("openclaw sessions cleanup")
...
run("openclaw daemon stop")
...
run("openclaw daemon start")
Recommendation

Run repair only when you are comfortable with OpenClaw being restarted and session cleanup occurring. Back up important configuration before using it.

What this means

Users may overestimate what the skill can guarantee or may rely on key rotation in ways that conflict with provider limits or policies.

Why it was flagged

The wording overpromises the reliability and availability of free model access. Provider rate limits, account policies, and failures can still apply.

Skill content
**One command. Unlimited free AI. No more rate limits.**
...
You'll never hit a rate limit again.
Recommendation

Treat the quota claims as marketing, not a guarantee. Check OpenRouter's current terms and limits before creating or rotating multiple keys.