Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Infinity Router

v2.1.0

Routes AI requests across free OpenRouter models for OpenClaw and Claude Code. Auto-discovers, scores, and configures the best free model with a smart fallba...

0· 65·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for genoshide/infinity-router.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Infinity Router" (genoshide/infinity-router) from ClawHub.
Skill page: https://clawhub.ai/genoshide/infinity-router
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install infinity-router

ClawHub CLI

Package manager switcher

npx clawhub@latest install infinity-router
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill is meant to route OpenRouter free models for OpenClaw/Claude Code and the code implements that: it fetches OpenRouter models, scores them, and reads/writes OpenClaw and Claude config files. However, the registry metadata lists no required env vars or config paths while SKILL.md and the code clearly require OPENROUTER_API_KEY and read/write ~/.openclaw/openclaw.json, ~/.openclaw/agents/main/agent/auth-profiles.json and ~/.claude/settings.json. The missing declared requirements in registry metadata is an incoherence.
Instruction Scope
Runtime instructions in SKILL.md align with the tool's purpose (install, set OPENROUTER_API_KEY, run pick/watch/daemon). The tool reads/writes user config files (~/.openclaw, ~/.claude), creates cache and state under ~/.infinity-router, and can POST rotation events to a user-supplied webhook. One inconsistency: SKILL.md/watch claims it 'Runs openclaw gateway restart automatically' on rotate, but the visible daemon.rotate implementation updates configs and fallbacks without calling any restart command — the automatic restart behavior may live in watcher.py or be only advisory. Also the CLI and docs mention filenames with slight naming inconsistencies (auth-profile.json vs auth-profiles.json) though code uses auth-profiles.json.
Install Mechanism
There is no registry install spec, but the project includes an install.sh that creates a local venv, pip-installs the package, and symlinks CLI binaries into /usr/local/bin. Symlinking to /usr/local/bin may require elevated permissions (install.sh does not use sudo), and will replace any existing names at that path. The installer also attempts to register a symlink under ~/.openclaw/workspace/skills. No network downloads from unknown hosts are present; dependencies are installed via pip.
!
Credentials
The tool legitimately requires OpenRouter API key(s) (OPENROUTER_API_KEY) and supports multiple keys for rotation. That credential is proportional to the stated purpose. The problem is the registry metadata omitted declaring this required env var. The code also reads the OpenClaw per-agent auth store and openclaw.json env block for keys — that is expected for integration but worth noting.
Persistence & Privilege
The skill does not request 'always: true' and uses normal user-level persistence (creates ~/.infinity-router, caches and rate-limit files, daemon-state.json). It can be run as a long-lived daemon (infinity-router-daemon / watch) which will autonomously rotate models. Autonomy combined with file writes is normal for this functionality but you should be aware a background process may change your OpenClaw/Claude model settings over time.
What to consider before installing
This package appears to implement exactly what it promises (auto-discovering and rotating free OpenRouter models), but there are a few things to check before installing: - The registry metadata omits required env/config declarations. SKILL.md and the code require OPENROUTER_API_KEY (you must set this) and the tool will read/write ~/.openclaw/openclaw.json and may read ~/.openclaw/agents/main/agent/auth-profiles.json and ~/.claude/settings.json. Back up those files before running the tool. - install.sh symlinks binaries into /usr/local/bin (may need sudo) and will replace any existing names there; inspect the script and decide whether to run it as your user or install via pipx/venv instead. - The tool stores cache and state under ~/.infinity-router (model-cache.json, rate-limits.json, daemon-state.json). If you run the daemon/watch it will run continuously and may rotate your models automatically. - The watcher can POST rotation events to a webhook you supply; do not provide a webhook you don't control — rotation events may include model IDs and other local state. - There are minor code/document inconsistencies (some filename typos and an odd formatting helper for the free router), which look like bugs rather than malicious behavior. If you require higher assurance, inspect watcher.py (not shown in full) to confirm whether it invokes external commands (e.g., openclaw gateway restart) or posts sensitive data to endpoints, and run the tool in a contained environment first. If you proceed: back up OpenClaw/Claude config files, set the OPENROUTER_API_KEY(s) you control, and consider running the CLI manually (not the daemon) until you verify behavior.

Like a lobster shell, security has layers — review code before you run it.

free-aivk970pqa7v83zwp1w1jym2bzhgx84mn92latestvk970pqa7v83zwp1w1jym2bzhgx84mn92llm-routingvk970pqa7v83zwp1w1jym2bzhgx84mn92model-fallbackvk970pqa7v83zwp1w1jym2bzhgx84mn92openclawvk970pqa7v83zwp1w1jym2bzhgx84mn92openroutervk970pqa7v83zwp1w1jym2bzhgx84mn92rate-limitvk970pqa7v83zwp1w1jym2bzhgx84mn92
65downloads
0stars
1versions
Updated 2w ago
v2.1.0
MIT-0

infinity-router

What it does

Configures OpenClaw (or Claude Code) to use free AI models from OpenRouter. Selects the best tool-capable model as primary, builds a ranked fallback chain so rate limits cause zero interruption, and leaves the rest of the config untouched.

Only chat models are selected — audio, image, video, and embedding models are automatically filtered out. Models that claim tool support but fail at runtime (e.g. Gemma) are excluded from tool scoring.

Prerequisites

1. API key(s)

# Single key
openclaw config set env.OPENROUTER_API_KEY "sk-or-v1-..."

# Multiple keys (comma-separated) — recommended to avoid daily free-tier limits
openclaw config set env.OPENROUTER_API_KEY "sk-or-v1-KEY1,sk-or-v1-KEY2,sk-or-v1-KEY3"

For OpenClaw inference key rotation, add each key as a separate profile in ~/.openclaw/agents/main/agent/auth-profiles.json:

{
  "version": 1,
  "profiles": {
    "openrouter:default": { "type": "api_key", "provider": "openrouter", "key": "sk-or-v1-KEY1" },
    "openrouter:key2":    { "type": "api_key", "provider": "openrouter", "key": "sk-or-v1-KEY2" },
    "openrouter:key3":    { "type": "api_key", "provider": "openrouter", "key": "sk-or-v1-KEY3" }
  }
}

Note: the file is auth-profiles.json (with s), not auth-profile.json.

2. Install

On Debian/Ubuntu servers (Python 3.12+), use the provided script:

cd /path/to/infinity-router
chmod +x install.sh
./install.sh
which infinity-router    # should return /usr/local/bin/infinity-router

To uninstall: ./uninstall.sh

Standard workflow

# 1. Configure best model + fallback chain
infinity-router pick

# 2. Apply to the running gateway
openclaw gateway restart

For a safer run that validates each model before writing (avoids stale/broken models):

infinity-router pick --validate
openclaw gateway restart

Command reference

CommandWhen to run
infinity-router pickSet up best free model + fallbacks (most common)
infinity-router pick --validateProbe each candidate before writing — avoids "Unknown model" errors
infinity-router pick -fKeep current primary, rebuild fallbacks only
infinity-router pick -c 10Use 10 fallbacks instead of default 5
infinity-router pick --authAlso add OpenRouter auth profile to OpenClaw
infinity-router scanBrowse all available free models
infinity-router scan -n 30Show all 30+ models
infinity-router use deepseekSet a specific model (partial name OK)
infinity-router use qwen3-coder -fAdd model to fallbacks only
infinity-router use deepseek --validateSet model and validate fallbacks
infinity-router benchLatency-test top 5 models
infinity-router bench -c 10Test top 10 models
infinity-router statusShow current config, all API keys, cache age
infinity-router watchTail gateway log, auto-rotate + restart on failures
infinity-router watch --verboseAlso print every matched failure line
infinity-router watch --notify URLPOST rotation event to webhook on each rotate
infinity-router resetRemove model config from target
infinity-router reset --clear-rlAlso clear rate-limit cooldown records

Always run openclaw gateway restart after any command that changes config.

Config targets

infinity-router pick                        # default: openclaw
infinity-router pick --target claude-code   # Claude Code settings.json

What gets written (OpenClaw)

Only these keys in ~/.openclaw/openclaw.json:

  • agents.defaults.model.primary — e.g. openrouter/meta-llama/llama-3.3-70b-instruct:free
  • agents.defaults.model.fallbacks — e.g. ["openrouter/free", "mistralai/mistral-small:free", …]
  • agents.defaults.models — model allowlist

The first fallback is always openrouter/free — OpenRouter's smart router that auto-picks the best available model for each request.

Daemon (auto-rotation)

infinity-router-daemon            # one-shot check
infinity-router-daemon --loop     # continuous monitoring
infinity-router-daemon --rotate   # force rotate now
infinity-router-daemon --status   # rotation history
infinity-router-daemon --clear-rl # reset all cooldowns

Daily maintenance

Run once a day or when models start failing:

rm -f ~/.infinity-router/model-cache.json
infinity-router pick
openclaw gateway restart

Troubleshooting

ProblemFix
infinity-router: command not foundRun ./install.sh from the project directory
OPENROUTER_API_KEY not setGet a free key at https://openrouter.ai/keys
Config not taking effectopenclaw gateway restart, then /new in Telegram
Unknown model errors in gateway logStale cache — rm ~/.infinity-router/model-cache.json && infinity-router pick --validate
Agent gives fake/hallucinated responsesModel doesn't support tools — run infinity-router pick --validate to get a real tool-capable model
All probes return rate_limitDaily free quota exhausted — wait for UTC midnight reset, or add more API keys
HTTP 429: free-models-per-dayAdd more keys comma-separated in env.OPENROUTER_API_KEY, or add separate profiles to auth-profiles.json
Something went wrong in TelegramRun infinity-router status to see active model, then openclaw gateway restart and /new

Comments

Loading comments...