Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenRouter Cron Migration
v1.0.0Collaboratively migrate specific OpenClaw cron jobs onto popular OpenRouter models. Audit cron usage, fetch the current OpenRouter rankings via curl, propose...
⭐ 0· 54·0 current·0 all-time
by@mrmps
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The described goal (audit cron usage, query OpenRouter rankings, propose and apply cron → model changes) matches the commands and steps in SKILL.md. Requesting an OpenRouter API key and calling the OpenRouter models API is coherent with the stated purpose.
Instruction Scope
The instructions explicitly read user config files (e.g., ~/.openclaw/.env, ~/.openclaw/agents/main/agent/auth-profiles.json, ~/.openclaw/openclaw.json) and reference the OPENROUTER_API_KEY environment variable, but the skill metadata lists no required env vars or config paths. The skill also runs commands that modify cron jobs (openclaw onboard, openclaw cron edit/run). Although it says to get explicit approval, the agent will be instructed to read and change user-managed configs and run jobs — these are sensitive operations and should have been declared.
Install Mechanism
Instruction-only skill with no install spec and no code files. This minimizes disk-write and supply-chain risk; nothing is downloaded or installed by the skill itself.
Credentials
The SKILL.md depends on an OpenRouter API key and inspects local OpenClaw configuration files, but the registry metadata declares no required environment variables or config paths. Asking for the OpenRouter key is reasonable for the task, but the lack of declared credentials/configs is an inconsistency and means the agent may request or access secrets unexpectedly.
Persistence & Privilege
The skill does not request always:true and does not include an install that alters other skills. It runs OpenClaw CLI commands that may persist provider onboarding (storing auth) — which is normal for onboarding — but this is limited to the OpenClaw config scope rather than system-wide privileges.
What to consider before installing
This skill appears to do what it says (audit crons, fetch OpenRouter rankings, and migrate approved jobs), but the runtime instructions will read files in your home directory (~/.openclaw/*.env, auth-profiles.json) and expect an OpenRouter API key. Before installing or invoking it: (1) confirm you trust the skill source (owner and homepage are unknown); (2) back up your OpenClaw cron configuration and auth files; (3) prefer to provide any API key via your normal secure mechanism (environment variable or OpenClaw onboarding) rather than pasting it into chat; (4) review which exact commands the agent will run and require explicit approval before any cron edit/run is executed; and (5) consider running the steps manually or in a test environment first. The main inconsistency is that the skill metadata declares no required env vars/config paths even though the instructions access them — treat that as a red flag and ask the publisher to correct the manifest or clarify what the skill will access.Like a lobster shell, security has layers — review code before you run it.
latestvk97bejf8rjjx7zv71rmndy4jw183qx7d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.