Skill blocked — malicious content detected

ClawHub Security flagged this skill as malicious. Downloads are disabled. Review the scan results below.

Free Models for OpenClaw and other Agents

v1.0.0

Discover and select free or low-cost AI models from OpenRouter optimized for agents with filtering by price, context, provider, and capabilities.

0· 0·0 current·0 all-time
bychristo@qidu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for qidu/free-models.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Free Models for OpenClaw and other Agents" (qidu/free-models) from ClawHub.
Skill page: https://clawhub.ai/qidu/free-models
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install qidu/free-models

ClawHub CLI

Package manager switcher

npx clawhub@latest install free-models
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name and description (discover cheap/free OpenRouter models) align with the provided code and SKILL.md. However the registry metadata lists no required environment variables or primary credential while both the SKILL.md and the script require OPENROUTER_API_KEY to run — an inconsistency between claimed requirements and actual runtime needs.
!
Instruction Scope
Runtime instructions explicitly instruct the user to set OPENROUTER_API_KEY and run the CLI; the script enforces presence of that env var. The script then performs network calls only to https://openrouter.ai/api/v1/models (expected). However the script checks for the API key but does not actually include it in the fetch request (no Authorization header), which is an odd inconsistency: the agent will demand a secret but not use it. That mismatch is suspicious and could be an accidental bug or an attempt to cause users to expose a key unnecessarily.
Install Mechanism
No install spec, no packages downloaded, no dependencies declared. The skill is instruction-plus-small JS script only, which is the lower-risk install pattern.
!
Credentials
The only environment variable referenced at runtime is OPENROUTER_API_KEY. Requesting a single API key for OpenRouter is proportionate for this purpose — but the registry failed to declare any required env vars while the SKILL.md and script require the key. Additionally, the code demands the key but never uses it in the network request, meaning users would be prompted to expose a credential unnecessarily.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide config, and has normal autonomous-invocation settings. It does not attempt to persist credentials or alter agent configuration beyond its own operation.
What to consider before installing
This skill's behavior is generally aligned with its description (it fetches model listings from OpenRouter), but there are clear inconsistencies you should address before installing: - Do not paste a sensitive OpenRouter API key into your environment until you confirm why it's required. The script checks for OPENROUTER_API_KEY but the fetch() call does not send the key. That could be an accidental bug, or it could be misleading the user into exposing a secret unnecessarily. - Ask the publisher to either (a) declare OPENROUTER_API_KEY in the registry metadata and fix the code to send the key in an Authorization header if the API requires it, or (b) remove the key check if the endpoint is public. A corrected fetch should include the API key in a header like: { Authorization: `Bearer ${API_KEY}` } if needed. - Review the network behavior: the script only calls https://openrouter.ai/api/v1/models. Ensure you trust that domain and are comfortable with the agent making outbound requests to it. - Because this is an instruction-only skill with a small script, you can also run it locally in a sandbox first (without real credentials) to observe behavior. If you must test with a real key, create a limited/test API key or run in an isolated environment. Given the inconsistency (registry vs SKILL.md/script and the unused-but-required API key), treat this as suspicious until the developer clarifies and fixes the mismatch.
scripts/free-models.js:13
Environment variable access combined with network send.
Critical security concern
These patterns indicate potentially dangerous behavior. Exercise extreme caution and review the code thoroughly before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk971dma11m34qk2hk5expt78qh82nrj5
0downloads
0stars
3versions
Updated 1mo ago
v1.0.0
MIT-0

name: free-models alias:

  • free-models-for-openclaw
  • free-models-of-openclaw
  • free-models-for-agents description: Discover free/cheap models from OpenRouter for AI agents (e.g. OpenClaw). Includes model discovery, filtering, and easy model selection for openclaw and other agent workflows. metadata: version: 0.2.0 homepage: https://openrouter.ai

free-models-for-agent

Discover free, cheap, and high-value models from OpenRouter for your OpenClaw and other AI agents.

Usage

Find free models

import { discoverFreeModels } from './scripts/free-models.js';

const models = await discoverFreeModels();
// Returns models with $0.00 or very low pricing

Filter by criteria

import { filterModels } from './scripts/free-models.js';

// High context + low price (best for tool calling)
const models = await filterModels({
  minContext: 200000,      // 200k+ tokens
  maxPromptPrice: 0.00001  // Under $0.00001/1M tokens
});

// Specific provider only
const openaiModels = await filterModels({
  author: 'openai',
  minContext: 100000
});

// Name contains filter
const flashModels = await filterModels({
  author: 'google',
  nameContains: 'flash'
});

// All filters combined
const cheapGoogle = await filterModels({
  author: 'google',
  minContext: 500000,
  maxPromptPrice: 0.000001
});

Get best free model for agent

import { getBestFreeModel } from './scripts/free-models.js';

// Best overall (highest context)
const bestModel = await getBestFreeModel();

// Best for reasoning tasks
const reasoningModel = await getBestFreeModel({
  needReasoning: true,
});

// Best for tool calling (high context is key)
const toolModel = await getBestFreeModel({
  preferReasoning: true,
  maxPrice: 0.00001
});

// Best for vision tasks
const visionModel = await getBestFreeModel({
  needVision: true,
});

CLI Usage

User should register and get a access key from https://openrouter.ai/settings/keys Openclaw should export the key (or string with a prefix "sk-or-") as the value of Environment Variable OPENROUTER_API_KEY before calling the cli.

export OPENROUTER_API_KEY="sk-or-v1-..."
node scripts/free-models.js

Common Free Models

ModelContextPriceBest For
x-ai/grok-4.1-fast2M$0.0000002/1MTool calling, agents
openai/gpt-5.41M$0.0000025/1MGeneral purpose
google/gemini-3.1-flash-lite1M$0.00000025/1MFast/cheap tasks
google/gemini-2.5-flash1M$0.0000003/1MTool calling
qwen/qwen3.5-flash-02-231M$0.0000001/1MBudget option

API Reference

fetchAllModels()

Returns all available models from OpenRouter.

discoverFreeModels()

Filters and returns only models with $0 or very low pricing (< $0.0001/1M).

filterModels(options)

Filters models by:

  • maxPromptPrice: Maximum prompt price per 1M tokens
  • minContext: Minimum context window (tokens)
  • author or provider: Model provider (e.g., 'anthropic', 'openai', 'google', 'deepseek', 'minimax', 'kimi', 'z.ai')
  • maxCompletionPrice: Maximum completion price per 1M tokens
  • nameContains: Filter by name substring

getBestFreeModel(options)

Returns the best free model based on:

  • needReasoning: Requires strong reasoning capability
  • preferReasoning: Prefers models with reasoning
  • needVision: Requires vision capabilities
  • maxPrice: Maximum price threshold

getModelsByAuthor(author)

Returns all models from a specific provider.

getCheapestModels(limit)

Returns the cheapest models (default: 10).

Resources

Comments

Loading comments...