Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenClaw Model Manager

v1.5.0

Fetch and display OpenRouter AI models with pricing and context limits, and configure OpenClaw to use selected models via automatic or fallback settings.

1· 1.2k·6 current·7 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The core code (manage_models.py) aligns with the stated purpose: it fetches OpenRouter model data, updates ~/.openclaw/openclaw.json, and plans/runs multi-step tasks. However, the package includes utilities (smart_find.py, smart_map.py, prompts that instruct sub-agents to read/write files) that extend beyond simple model listing/configuration into arbitrary filesystem inspection and code-generation workflows. Additionally, metadata declares no required binaries, yet the code invokes the 'openclaw' CLI — an undeclared dependency (incoherence).
!
Instruction Scope
SKILL.md and the scripts advertise a 'plan' and optional 'execute' mode that spawns sub-agents (openclaw sessions spawn) which will be given tasks and prompts that explicitly instruct them to read and write files (SPEC.md, PLAN.md, code files, AUDIT.md). The included smart_find utility walks the filesystem and can read arbitrary files; smart_map parses codebases. Running 'plan --execute' can therefore cause local files to be read, new files to be created, and sub-agents to run arbitrary tasks — behavior that is broader than a simple model-pricing tool and could expose sensitive local data if executed in sensitive directories.
Install Mechanism
There is no remote install spec or downloads; the skill is delivered as source files. That lowers install-time risk (no external arbitrary code fetch in the install step).
!
Credentials
The skill declares no required environment variables or primary credential, but it performs network calls to https://openrouter.ai/api/v1/models and spawns 'openclaw' subcommands. The 'openclaw' CLI requirement is not declared in the registry metadata. The skill will also read/write configuration and workspace files under ~/.openclaw, which is reasonable for a model manager but is a privileged local footprint that should have been documented as required. Prompts instruct sub-agents to create and read files in the current working directory, which may access user data unexpectedly.
Persistence & Privilege
The skill modifies the user's OpenClaw configuration (~/.openclaw/openclaw.json) and writes workspace files (~/.openclaw/workspace/*). It does not set always:true, which is appropriate, but these filesystem/config modifications are persistent and have system impact. Combined with its ability to spawn sub-agents, this grants it meaningful operational privilege — acceptable for a model manager but important for users to understand before enabling automatic modes.
What to consider before installing
This skill is not clearly malicious, but it has several surprising behaviors you should consider before installing or running it: - Undeclared dependency: The code calls the 'openclaw' CLI (openclaw sessions spawn) but the skill metadata does not list any required binaries. Confirm you have the 'openclaw' binary and understand what 'openclaw sessions spawn' does in your environment. - Broad filesystem access: Utilities (smart_find.py, smart_map.py) and the sub-agent prompts will read and write files in the current directory and under ~/.openclaw. Do not run this in directories containing sensitive data (home, projects with secrets) unless you audit the code and accept the risk. - Sub-agent execution: The optional --execute mode launches sub-agents that receive tasks and prompts to create files and audit code. Those sub-agents may have network access and could transmit data depending on your OpenClaw/OpenRouter configuration. Run initial tests in an isolated environment (container or throwaway VM) and back up ~/.openclaw/openclaw.json first. - Review prompts and code: Inspect prompts.json (it instructs generated agents to use 'write' to create files) and manage_models.py to verify no unexpected network endpoints or data-exfiltration code. The repository includes no hidden remote downloads, which reduces supply-chain risk, but the runtime behavior itself is powerful. If you plan to use this skill: 1) Run it in a safe sandbox first and exercise only 'list' and 'plan' modes without --execute. 2) Back up ~/.openclaw/openclaw.json and any important workspace files. 3) Audit and, if needed, modify the code that spawns sessions to restrict which models/tasks can be launched or to disable automatic execution. 4) Ask the author (or project repo) for clarification about the 'openclaw' CLI dependency and explicit consent flow for spawning sub-agents. If you want, I can produce a short checklist of exact lines to review/change in manage_models.py to limit filesystem or network exposure.

Like a lobster shell, security has layers — review code before you run it.

gatewayvk97a5t9d2z070pz8xwfwfzn6bs81pv2elatestvk974y5d2wzemdkbjb9r40y018h822vvfmodelsvk97a5t9d2z070pz8xwfwfzn6bs81pv2eopenclawvk97a5t9d2z070pz8xwfwfzn6bs81pv2eopenroutervk97a5t9d2z070pz8xwfwfzn6bs81pv2e
1.2kdownloads
1stars
7versions
Updated 5h ago
v1.5.0
MIT-0

OpenClaw Model Manager v1.5 🛠️

💰 Optimize Your API Costs: Route Simple Tasks to Cheaper Models.

Why pay $15/1M tokens for simple translations or summaries when you can pay $0.60/1M? That's a 25x price difference (96% savings) for suitable tasks.

🆕 NEW in v1.5:

  • Enhanced Integration with model-benchmarks for real-time AI intelligence
  • Improved Cost Calculations with latest pricing data
  • Better Task Classification with expanded routing patterns
  • Stability Improvements and bug fixes

🚀 Quick Start

# List models with real-time pricing
python3 skills/model-manager/manage_models.py list

# Get routing recommendations  
python3 skills/model-manager/manage_models.py plan "write a Python script"

# Configure OpenClaw for cost optimization
python3 skills/model-manager/manage_models.py enable cheap

🇨🇳 中文说明

💰 拒绝冤枉钱!自动路由高性价比模型,最高节省 96% Token 费用。

🆕 v1.5 新功能:

  • 智能数据源整合 — 配合 model-benchmarks 技能获取实时 AI 能力评测
  • 精准成本计算 — 基于最新价格数据的成本估算
  • 增强任务识别 — 更准确的任务类型分类和模型推荐
  • 稳定性提升 — 修复已知问题,提升运行可靠性

这个 Skill 能帮你:

  1. 即时比价:列出当前 OpenRouter 上的模型价格
  2. 智能配置:自动将简单任务路由给高性价比的小模型(如 GPT-4o-mini)
  3. 🆕 数据驱动推荐:结合 AI benchmark 数据提供最优模型建议
  4. 🧠 自我进化 (Self-Healing):如果便宜模型经常失败,系统会自动切换到更稳定的模型

⚙️ Core Functions

1️⃣ list - Real-Time Model Pricing

python3 manage_models.py list

Fetches current OpenRouter pricing and displays cost-effective options.

2️⃣ plan - Smart Task Routing

python3 manage_models.py plan "translate this to French"
python3 manage_models.py plan "debug this Python error: TypeError..."
python3 manage_models.py plan "design a database schema"

NEW in v1.5: Enhanced task classification with better accuracy for:

  • 🔧 Technical tasks (coding, debugging, system design)
  • 📝 Content tasks (writing, translation, summarization)
  • 🧠 Analysis tasks (data analysis, reasoning, research)

3️⃣ enable - Auto-Configuration

python3 manage_models.py enable cheap    # Maximum cost savings
python3 manage_models.py enable balanced # Quality/cost balance
python3 manage_models.py enable quality  # Best performance

4️⃣ benchmark - Performance Analysis (NEW v1.5)

python3 manage_models.py benchmark --task coding

Integrates with model-benchmarks skill for data-driven recommendations.


💡 Integration with Model Benchmarks

Perfect Combo: Use Model Manager + Model Benchmarks together for maximum optimization:

# 1. Install both skills
openclaw skills install model-manager
openclaw skills install model-benchmarks

# 2. Get real-time AI intelligence
python3 skills/model-benchmarks/scripts/run.py fetch

# 3. Apply intelligent routing
python3 skills/model-manager/manage_models.py plan "your task" --use-benchmarks

Result: Up to 95% cost reduction with maintained or improved quality!


🎯 Task Classification Engine

Enhanced in v1.5 with better pattern recognition:

Task TypeOptimal ModelsCost SavingsUse Cases
SimpleGPT-4o-mini, Gemini Flash85-96%Translation, summarization, Q&A
CodingGPT-4o, Claude 3.5 Sonnet45-75%Programming, debugging, code review
CreativeClaude 3.5 Sonnet, GPT-4o25-55%Writing, brainstorming, content creation
ComplexClaude 3.5 Sonnet, GPT-415-35%Architecture, research, complex analysis

📊 Real-World Results

User Reports (v1.5):

  • 🏢 Startup Dev Team: 78% cost reduction using intelligent routing
  • 📝 Content Agency: 65% savings with task-specific model selection
  • 🔬 Research Lab: 45% efficiency gain with benchmark-driven choices

🔄 Changelog v1.5

✅ New Features

  • Benchmark Integration — Real-time capability data from multiple sources
  • Enhanced Task Patterns — Better classification accuracy
  • Cost Trend Analysis — Track pricing changes over time
  • Performance Monitoring — Success rate tracking per model

🐛 Bug Fixes

  • Fixed OpenRouter API timeout issues
  • Improved error handling for network failures
  • Better handling of model availability changes
  • Resolved config file corruption edge cases

⚡ Performance Improvements

  • 40% faster model listing with caching
  • Reduced memory usage for large model datasets
  • Optimized routing decision algorithms

🛠️ Advanced Usage

Custom Routing Rules

# Create custom routing in ~/.openclaw/model-routing.json
{
  "patterns": {
    "translation": ["gemini-2.0-flash", "gpt-4o-mini"],
    "coding": ["claude-3.5-sonnet", "gpt-4o"],
    "analysis": ["gpt-4o", "claude-3.5-sonnet"]
  },
  "fallbacks": ["gpt-4o-mini"],
  "budget_limit": 50.00
}

Cost Monitoring

# Set up cost alerts
python3 manage_models.py monitor --budget 100 --alert-at 80%

Performance Analytics

# Generate routing report
python3 manage_models.py report --days 30 --export csv

🚀 Roadmap

v1.6 (Coming Soon)

  • Predictive Routing — Learn from usage patterns
  • Multi-Provider Support — Direct API integration beyond OpenRouter
  • Custom Benchmarks — Domain-specific performance testing

v2.0 (Future)

  • Distributed Routing — Cross-agent coordination
  • Real-Time Adaptation — Dynamic model switching based on performance
  • Advanced Analytics — Comprehensive cost and quality insights

🤝 Community

Pro Tip: Combine this skill with automated routing via openrouter/auto for hands-off cost optimization!


Make every token count — route smart, save big! 🛠️

Comments

Loading comments...