!
Purpose & Capability
The SKILL.md and the bundled script clearly require an OpenRouter API key and perform API calls to openrouter.ai. However the registry metadata lists no required environment variables or primary credential. That is an incoherence: the skill needs credentials to function but the package metadata does not declare them.
!
Instruction Scope
Instructions and the script perform network calls to OpenRouter, cache results under ~/.openclaw/state, and (per SKILL.md) can auto-update openclaw.json and models.json and optionally restart the gateway. Modifying agent configuration and restarting services is within the stated purpose but is a sensitive operation and the SKILL.md does not clearly constrain which paths will be written or provide safety checks. The script also recommends cron scheduling for autonomous periodic runs.
✓
Install Mechanism
No install spec; the skill ships an instruction file and a local Python script. There is no remote download or archive extraction. That keeps install risk relatively low compared to pulling remote binaries.
!
Credentials
The script expects an API key (CLI flag default is $OPENROUTER_API_KEY) but the skill metadata declares no required env or primary credential. Requesting an OpenRouter API key is proportionate to the stated task, but metadata omission is misleading. No other unrelated credentials are requested in files provided.
!
Persistence & Privilege
The script writes cache to ~/.openclaw/state and (per SKILL.md) will update openclaw.json and models.json and optionally restart a gateway. Those are persistent and privileged actions affecting agent configuration and runtime. While plausible for a rotation tool, this behavior increases blast radius and should be enabled only after auditing the code and backing up configs. always:false (not force-installed) mitigates some risk.
What to consider before installing
Key points to consider before installing or running this skill:
- Metadata mismatch: the script expects an OpenRouter API key (CLI flag or $OPENROUTER_API_KEY) but the skill metadata lists no required env — treat that as a red flag and supply credentials only after review.
- Review the rest of the bundled code (the provided file is truncated in the listing): specifically locate and inspect functions that write to openclaw.json, models.json, cache files, and any gateway restart logic. Confirm they only modify intended files and use safe atomic writes/backups.
- Run initial tests in read-only mode: use --scan or --no-update, --use-cache, and avoid --restart until you confirm outputs. Save JSON reports (--json) and inspect before applying changes.
- Backup configs: back up your openclaw.json and models.json before letting the script auto-update them or before adding a cron job.
- Limit credential scope: if OpenRouter supports scoped/limited keys, use a limited key for testing. Do not paste high-privilege keys into cron entries or world-readable scripts.
- Permissions & sandboxing: consider running the script under a dedicated service account or container so its filesystem effects are constrained to ~/.openclaw or a designated directory.
- Automation caution: the SKILL.md recommends cron every 6 hours and the script can restart a gateway — only enable automated runs after code review and confirming behavior.
If you want, I can: (a) finish reviewing the remainder of the bundled script for the exact config-write and restart calls (the file listing was truncated), or (b) produce a checklist and safe example commands to run the script in audit mode.
