Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Models for OpenClaw and other Agents

v0.3.0

Discover, filter, and select free or low-cost AI models from OpenRouter for OpenClaw and other agent workflows based on context, price, and capabilities.

0· 535·3 current·3 all-time
bychristo@qidu·duplicate of @qidu/free-models

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for qidu/free-models-for-openclaw.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Free Models for OpenClaw and other Agents" (qidu/free-models-for-openclaw) from ClawHub.
Skill page: https://clawhub.ai/qidu/free-models-for-openclaw
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install free-models-for-openclaw

ClawHub CLI

Package manager switcher

npx clawhub@latest install free-models-for-openclaw
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to discover free/cheap models from OpenRouter and the code indeed queries OpenRouter's models endpoint and filters results — this matches the stated purpose. However, registry metadata declares no required environment variables or primary credential while SKILL.md and the code require an OPENROUTER_API_KEY; that metadata omission is inconsistent.
!
Instruction Scope
SKILL.md instructs users to export OPENROUTER_API_KEY and run the CLI. The runtime file enforces that the env var is set (it exits if not), but the fetch call to https://openrouter.ai/api/v1/models does not include the API key in headers or query parameters — either the key is unnecessary for that endpoint or the code is buggy. The instructions therefore reference an env var that is not declared in the registry and not actually used for requests, which is a scope/accuracy problem that could mislead users.
Install Mechanism
There is no install spec (instruction-only skill with included source files). No third-party downloads or package installs are required and there are no dependencies — this is low-risk from an installation/remote-code-fetch perspective.
!
Credentials
Requiring a single OPENROUTER_API_KEY is proportionate to the stated purpose (accessing OpenRouter). But the registry metadata fails to declare this required env var or primary credential, and the code checks for the key but does not use it when making API calls — a mismatch that should be fixed or clarified. There are no additional unrelated secrets requested.
Persistence & Privilege
The skill does not request persistent/always-on presence, does not modify other skills or system settings, and does not request access to config paths. Default invocation and user-invocable settings are normal.
What to consider before installing
This skill appears to do what it says (query OpenRouter and filter models), but there are a few red flags to resolve before trusting it: 1) The registry metadata does not list OPENROUTER_API_KEY even though SKILL.md and the CLI tell you to export it — the registry should declare this env var. 2) The runtime checks for OPENROUTER_API_KEY but never attaches it to the fetch request; that is likely a bug (or the endpoint is public). Ask the author to either (a) update the registry metadata to list OPENROUTER_API_KEY as the primary credential and/or (b) fix the code to send the key to OpenRouter as required (for example add an Authorization header or the correct header parameter). If you must run it now, do so in an isolated environment and inspect/modify scripts/free-models.js to ensure it sends credentials only to api.openrouter.ai and behaves as expected. If you want higher assurance, request a corrected manifest (declare OPENROUTER_API_KEY) and a code update that shows how the key is used (e.g., Authorization: Bearer).
scripts/free-models.js:13
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97b4hrfc78exs1za3rf30ga2h82rzwk
535downloads
0stars
1versions
Updated 5h ago
v0.3.0
MIT-0

name: free-models alias:

  • free-models-for-openclaw
  • free-models-of-openclaw
  • free-models-for-agents description: Discover free/cheap models from OpenRouter for AI agents (e.g. OpenClaw). Includes model discovery, filtering, and easy model selection for openclaw and other agent workflows. metadata: version: 0.2.0 homepage: https://openrouter.ai

free-models-for-agent

Discover free, cheap, and high-value models from OpenRouter for your OpenClaw and other AI agents.

Usage

Find free models

import { discoverFreeModels } from './scripts/free-models.js';

const models = await discoverFreeModels();
// Returns models with $0.00 or very low pricing

Filter by criteria

import { filterModels } from './scripts/free-models.js';

// High context + low price (best for tool calling)
const models = await filterModels({
  minContext: 200000,      // 200k+ tokens
  maxPromptPrice: 0.00001  // Under $0.00001/1M tokens
});

// Specific provider only
const openaiModels = await filterModels({
  author: 'openai',
  minContext: 100000
});

// Name contains filter
const flashModels = await filterModels({
  author: 'google',
  nameContains: 'flash'
});

// All filters combined
const cheapGoogle = await filterModels({
  author: 'google',
  minContext: 500000,
  maxPromptPrice: 0.000001
});

Get best free model for agent

import { getBestFreeModel } from './scripts/free-models.js';

// Best overall (highest context)
const bestModel = await getBestFreeModel();

// Best for reasoning tasks
const reasoningModel = await getBestFreeModel({
  needReasoning: true,
});

// Best for tool calling (high context is key)
const toolModel = await getBestFreeModel({
  preferReasoning: true,
  maxPrice: 0.00001
});

// Best for vision tasks
const visionModel = await getBestFreeModel({
  needVision: true,
});

CLI Usage

User should register and get a access key from https://openrouter.ai/settings/keys Openclaw should export the key (or string with a prefix "sk-or-") as the value of Environment Variable OPENROUTER_API_KEY before calling the cli.

export OPENROUTER_API_KEY="sk-or-v1-..."
node scripts/free-models.js

Common Free Models

ModelContextPriceBest For
x-ai/grok-4.1-fast2M$0.0000002/1MTool calling, agents
openai/gpt-5.41M$0.0000025/1MGeneral purpose
google/gemini-3.1-flash-lite1M$0.00000025/1MFast/cheap tasks
google/gemini-2.5-flash1M$0.0000003/1MTool calling
qwen/qwen3.5-flash-02-231M$0.0000001/1MBudget option

API Reference

fetchAllModels()

Returns all available models from OpenRouter.

discoverFreeModels()

Filters and returns only models with $0 or very low pricing (< $0.0001/1M).

filterModels(options)

Filters models by:

  • maxPromptPrice: Maximum prompt price per 1M tokens
  • minContext: Minimum context window (tokens)
  • author or provider: Model provider (e.g., 'anthropic', 'openai', 'google', 'deepseek', 'minimax', 'kimi', 'z.ai')
  • maxCompletionPrice: Maximum completion price per 1M tokens
  • nameContains: Filter by name substring

getBestFreeModel(options)

Returns the best free model based on:

  • needReasoning: Requires strong reasoning capability
  • preferReasoning: Prefers models with reasoning
  • needVision: Requires vision capabilities
  • maxPrice: Maximum price threshold

getModelsByAuthor(author)

Returns all models from a specific provider.

getCheapestModels(limit)

Returns the cheapest models (default: 10).

Resources

Comments

Loading comments...