Free AI API Discovery and Routing

Discover which free or low-cost AI APIs are reachable from the current environment, verify them safely, and recommend a task-to-provider routing plan.

Security Scan

The skill's requirements and instructions are coherent with its stated purpose (network reachability probes and capability checks) and it does not request unrelated credentials or installs, though users should be aware of network-scanning and credential-handling risks described below.

Purpose & Capability

The name and description match the instructions: the SKILL.md explains probing endpoints, capability checks, and routing recommendations. No unrelated environment variables, binaries, or installs are requested.

Instruction Scope

Instructions stay within discovery/routing scope and include sensible guardrails (ask before verifying credentials, mask secrets, don't store keys without approval). However, they are somewhat vague about where probe results are recorded/transmitted and how approval is obtained; that ambiguity could lead to accidental logging or transmission of sensitive data if not implemented carefully. Also, network probing may be disallowed or sensitive in some environments.

Install Mechanism

Instruction-only skill with no install spec or code files — nothing is written to disk or fetched during install, which limits installation risk.

Credentials

The skill declares no required env vars, credentials, or config paths. It does instruct asking the user for keys if needed, which is appropriate for verifying provider access; the guardrails about masking and explicit storage approval are present.

Persistence & Privilege

No always:true, no install-time persistence requested, and the SKILL.md explicitly warns against storing API keys without explicit approval. The skill does not request elevated or cross-skill configuration changes.

Scan Findings in Context

[NO_SCAN_ARTIFACTS] expected: The regex-based scanner had nothing to analyze because this is an instruction-only SKILL.md; that is expected for a pure instruction skill.

Assessment

This skill appears to do what it says: probe reachable AI provider endpoints and recommend routing. Before using it, consider: (1) run probes from an environment where outgoing network scans are allowed (corporate or sensitive networks may block or audit such traffic); (2) never paste long-lived or high-privilege API keys into the agent unless you explicitly consent and understand how/where they will be used and stored; (3) confirm where probe results and logs will be saved or transmitted (avoid automatic upload to third-party endpoints); (4) restrict testing to a curated list of known/trusted providers and avoid probing arbitrary or internal URLs; and (5) if you need stricter guarantees, run the example probe code locally in an isolated environment and inspect outputs/logging behavior before handing credentials to any agent.

When to use

• You need to find which AI APIs are reachable from the current environment.
• You want a low-cost fallback when a preferred provider is unavailable.
• You need a simple routing recommendation for chat, code, speech, or multimodal tasks.

Workflow

1. Check network reachability. Probe candidate endpoints with a short timeout and record whether the host is reachable.
2. Verify credentials only after approval. Ask for the minimum key needed and avoid printing full secrets in logs.
3. Test one capability at a time. Confirm chat, model listing, speech, or image endpoints separately.
4. Recommend routing. Map each task type to the lowest-cost reliable provider that actually worked.

Example reachability probe

import socket
import ssl
import urllib.error
import urllib.request

socket.setdefaulttimeout(8)
ctx = ssl.create_default_context()

services = {
    "Groq": "https://api.groq.com",
    "OpenRouter": "https://openrouter.ai/api/v1",
    "DeepSeek": "https://api.deepseek.com",
    "Mistral": "https://api.mistral.ai/v1",
}

for name, url in services.items():
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, context=ctx, timeout=6) as resp:
            print(f"{name}: HTTP {resp.status}")
    except urllib.error.HTTPError as exc:
        print(f"{name}: HTTP {exc.code} (reachable, auth may be required)")
    except Exception as exc:
        print(f"{name}: not reachable ({exc})")

Recommended output

• Reachable providers
• Providers that need valid credentials
• Best provider by task type
• Cost or quota notes
• Risks or missing coverage

Guardrails

• Do not store API keys unless the user explicitly approves it.
• Mask secrets in notes and logs.
• Keep routing recommendations based on verified results, not assumptions.
• Treat provider availability and quotas as time-sensitive and re-check when needed.