Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Intelligent Router Openclaw
v1.0.0Intelligent model routing for sub-agent task delegation. Choose the optimal model based on task complexity, cost, and capability requirements. Reduces costs...
⭐ 0· 58·1 current·1 all-time
byRene Cabrera@nicocabrerac
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the included code: the scripts implement task classification, tiering, model discovery, policy enforcement and spawn helpers. However the skill's registry metadata declared no required environment or config access while the code expects and uses the user's OpenClaw config (~/.openclaw/openclaw.json) and provider API keys to test model endpoints — a capability that is reasonable for the stated purpose but is not represented in the declared requirements.
Instruction Scope
SKILL.md instructs users to run install.sh which unconditionally patches AGENTS.md with a mandatory protocol. The runtime instructions also direct the agent to run discovery and policy checks that read OpenClaw configuration and may invoke the openclaw CLI. Writing/injecting into AGENTS.md and instructing mandatory pre-spawn checks are scope-expanding behaviors that affect global agent policy and documentation.
Install Mechanism
There is no external download; the installer is a local install.sh that appends text to AGENTS.md and runs a test classification. No remote archives or package installs are fetched. The risk comes from the installer modifying a repository/global file without interactive confirmation rather than from an untrusted download.
Credentials
The skill declares no required env vars or credentials, yet multiple scripts read ~/.openclaw/openclaw.json (to obtain provider configs and API keys) and write to workspace files like provider-health and discovered-models. The skill will exercise those provider API keys (discover_models.py performs live HTTP inference tests). Access to those credentials is proportionate to model discovery but should have been declared explicitly.
Persistence & Privilege
The skill is not always:true, but install.sh persistently injects policy text into AGENTS.md (a global project/agent document). It also installs cron wrapper scripts and provides cron-related helpers (auto_refresh_models.sh). Modifying AGENTS.md and encouraging cron usage gives the skill persistent influence over agent behavior and environment conventions.
What to consider before installing
This skill appears to implement a legitimate router, but exercise caution before installing. Key points to consider:
- Back up AGENTS.md (and your repo) before running install.sh — the installer will auto-inject a mandatory protocol into that file without interactive approval.
- Review ~/.openclaw/openclaw.json and understand that the scripts will read provider API keys from it and may perform live HTTP calls (discover_models.py). If you don’t want those keys used, either run discovery in config-only mode or remove/replace keys first.
- The skill writes workspace files (discovered-models.json, provider-health.json) under ~/.openclaw; check file paths and permissions if that is a concern.
- The policy enforcer uses the openclaw CLI to audit crons; the audit path requires the CLI to be present and may try to list/inspect system cron entries via OpenClaw.
- If you want to evaluate behavior safely: inspect the scripts locally, run router.py in a controlled environment (with no or dummy config.json), and run discover_models.py with live=False to avoid network calls.
If these effects (global AGENTS.md modification, reading API keys, making network tests, adding cron helpers) are acceptable, the skill is coherent with its purpose. If not, do not install or run the install.sh; ask the skill author to make modifications (explicit opt-in for AGENTS.md injection and declare config/credential access).Like a lobster shell, security has layers — review code before you run it.
latestvk97dhnwqsvpkmyh6yxc14j8vmx84njeb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.