Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Model Intel Pro

v1.0.0

Live LLM model pricing and capabilities from OpenRouter. List top models, search by name, compare side-by-side, find best model for a use case, check pricing...

0· 733·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for aiwithabidi/model-intel-pro.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Model Intel Pro" (aiwithabidi/model-intel-pro) from ClawHub.
Skill page: https://clawhub.ai/aiwithabidi/model-intel-pro
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: OPENROUTER_API_KEY
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install model-intel-pro

ClawHub CLI

Package manager switcher

npx clawhub@latest install model-intel-pro
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the code: the script fetches model data from https://openrouter.ai and provides list/search/compare/best/price commands. However the skill declares OPENROUTER_API_KEY as required even though the HTTP requests in the included script do not actually use that key (no header/param). That mismatch is unexpected — either the API key is unnecessary or the script is buggy/unfinished.
!
Instruction Scope
SKILL.md instructs running the bundled Python script, which is fine. The script, however, will attempt to read ~/.openclaw/workspace/.env to extract OPENROUTER_API_KEY if the env var is not set. The manifest said no required config paths; reading a workspace dotfile in the user's home is an access beyond the declared scope and should have been listed. The script does not read other arbitrary files, but the undeclared home path access is a scope mismatch.
Install Mechanism
No install spec is present (instruction-only). That minimizes install-time risk. The bundle includes a single Python script which will be executed; there's no downloader, third-party install, or archive extraction.
!
Credentials
The only required env var is OPENROUTER_API_KEY, which is reasonable for an OpenRouter integration. But the script reads the API key from ~/.openclaw/workspace/.env as a fallback and then never uses the key in its requests. This either indicates sloppy/unfinished code or unnecessary access to a file that may contain other secrets. Requesting a credential and not using it is disproportionate and confusing.
Persistence & Privilege
The skill does not request always: true and does not attempt to persist itself or modify other skills or system settings. It runs on-demand and performs network calls only to openrouter.ai.
What to consider before installing
This skill appears to implement the advertised model-intel functionality (it fetches model data from openrouter.ai and prints comparisons), but there are a couple of red flags: 1) it declares OPENROUTER_API_KEY but the HTTP requests do not use the key (no Authorization header or API param), and 2) the script will try to read ~/.openclaw/workspace/.env for the key even though the manifest lists no required config paths. These could be harmless (a bug or unfinished code) but could also mean the author intended to use the key or access workspace config in ways not declared. Before installing: review the script yourself (it’s short), run it in an isolated environment or sandbox, and avoid exposing a real API key until you confirm where it is sent. Prefer setting the env var only for ephemeral sessions, or remove the key from your home .env if you don’t want it read. If you need higher assurance, ask the publisher to explain why the key is declared but not used and to remove the fallback file read or declare it explicitly.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython3
EnvOPENROUTER_API_KEY
latestvk97845wf1ejt8chkk8jtkrcasx817kpsmodelsvk97845wf1ejt8chkk8jtkrcasx817kpspricingvk97845wf1ejt8chkk8jtkrcasx817kps
733downloads
0stars
1versions
Updated 1h ago
v1.0.0
MIT-0

Model Intel 🧠💰

Live LLM model intelligence — pricing, capabilities, and comparisons from OpenRouter.

When to Use

  • Finding the best model for a specific task (coding, reasoning, creative, fast, cheap)
  • Comparing model pricing and capabilities
  • Checking current model availability and context lengths
  • Answering "what's the cheapest model that can do X?"

Usage

# List top models by provider
python3 {baseDir}/scripts/model_intel.py list

# Search by name
python3 {baseDir}/scripts/model_intel.py search "claude"

# Side-by-side comparison
python3 {baseDir}/scripts/model_intel.py compare "claude-opus" "gpt-4o"

# Best model for a use case
python3 {baseDir}/scripts/model_intel.py best fast
python3 {baseDir}/scripts/model_intel.py best code
python3 {baseDir}/scripts/model_intel.py best reasoning
python3 {baseDir}/scripts/model_intel.py best cheap
python3 {baseDir}/scripts/model_intel.py best vision

# Pricing details
python3 {baseDir}/scripts/model_intel.py price "gemini-flash"

Use Cases

CommandWhen
best fastNeed lowest latency
best cheapBudget-constrained
best codeProgramming tasks
best reasoningComplex logic/math
best visionImage understanding
best long-contextLarge document processing

Credits

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation

Comments

Loading comments...