Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Chinese LLM Router
v1.0.0Route OpenClaw chats to top Chinese LLMs with smart model selection, auto-fallback, cost tracking, and unified OpenAI-compatible API access.
⭐ 0· 884·3 current·3 all-time
byxund@xdd-xund
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The code (router.js + setup.js) implements a model router for the listed Chinese providers and requires provider API keys — this matches the skill's description. Minor mismatch: SKILL.md claims it 'reads API keys from environment or from ~/.chinese-llm-router/config.json', but the shipped code only reads/writes the config file (no environment-variable fallback is implemented).
Instruction Scope
Runtime instructions are limited to running the interactive setup and using the router CLI or exported functions. The scripts only read/write ~/.chinese-llm-router/config.json and make HTTP(S) calls to provider baseUrls. SKILL.md mentions features like 'cost tracking' and 'context-aware' preferences which are advertised but not implemented in the provided code (no persistent per-conversation preference store or token accounting found).
Install Mechanism
There is no install spec; this is instruction-plus-scripts only. Nothing is downloaded from external URLs during install. Risk is low because no archive/executable is pulled from unknown hosts.
Credentials
The skill asks the user to provide API keys for multiple Chinese LLM providers — this is proportionate to a router that can use many providers. Registry metadata declared no required env vars, but SKILL.md suggests env-var support (which the code does not implement). API keys are stored in a config file under the user's home directory; that is expected but sensitive.
Persistence & Privilege
The skill writes a config file to ~/.chinese-llm-router/config.json and creates the directory if needed. It does not request elevated or system-wide privileges, does not set always:true, and does not modify other skills or agent-wide settings.
Assessment
Key points before installing:
- Function/purpose: The code is a straightforward router that reads API keys from ~/.chinese-llm-router/config.json (setup.js) and sends chat requests to provider baseUrls; this matches the skill description. Expect to provide API keys for any provider you want to use.
- SKILL.md inaccuracies: The README says it reads keys from environment variables OR the config file, but the provided code only reads the config file. Also several advertised features (cost tracking, persistent per-conversation model preferences) are not present in the provided scripts — they may be planned features, not implemented.
- Sensitive data: The setup script saves your provider API keys to ~/.chinese-llm-router/config.json. Protect that file (set permissions, e.g., chmod 600) and only enter keys for providers you trust. Any prompt you send through this router will be transmitted to the configured provider(s) and may be logged or retained by them.
- Bug to be aware of: router.js constructs the request URL in a way that duplicates the path (it appends '/chat/completions' twice), which will likely break calls to providers as-is. If you encounter failures, inspect chatCompletion() and adjust the path construction (use the URL's pathname without re-appending '/chat/completions').
- Operational advice: Review the config file after running setup to confirm keys/baseUrls are correct. If you prefer not to type keys interactively, you can create the config.json yourself with correct structure. Test providers with the CLI 'node scripts/router.js test <model>' before relying on the skill.
Overall recommendation: The skill appears coherent and not malicious, but review and harden the local config file and be aware of the documentation/code mismatches and the URL path bug before use.Like a lobster shell, security has layers — review code before you run it.
chinesevk97d9hj4sdg8nrzg5gfxe2j7dn8194hbdeepseekvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbdoubaovk97d9hj4sdg8nrzg5gfxe2j7dn8194hbglmvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbkimivk97d9hj4sdg8nrzg5gfxe2j7dn8194hblatestvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbllmvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbminimaxvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbqwenvk97d9hj4sdg8nrzg5gfxe2j7dn8194hbroutervk97d9hj4sdg8nrzg5gfxe2j7dn8194hbstepvk97d9hj4sdg8nrzg5gfxe2j7dn8194hb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
