Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Auto Router
v1.0.0Routage automatique vers le modèle optimal selon le type de question (local gratuit vs API payant)
⭐ 0· 372·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes routing between local models (Llama/Qwen) and API models (Claude Sonnet/Opus). However the package does not include the referenced auto-router.js implementation, does not provide or install local models, and declares no required binaries or credentials even though the instructions explicitly call 'node' and mention API models. That set of omissions is inconsistent with the stated purpose.
Instruction Scope
Runtime instructions and examples repeatedly reference /Users/thibaut/clawd/auto-router.js and show running 'node /Users/thibaut/clawd/auto-router.js'. The included shell wrapper cds into /Users/thibaut/clawd and execs node auto-router.js. The SKILL.md also mentions keeping local models loaded and routing to external APIs, but gives no concrete, included code or declared environment variables for API credentials. The instructions therefore require access to user filesystem and runtime state that are not declared or provided.
Install Mechanism
There is no install spec (instruction-only), which limits what is written by the skill. That is lower risk in isolation, but is inconsistent with the SKILL.md's expectations of heavy local model setup and a node program. The wrapper will attempt to run a local Node script if present; the skill does not install anything itself.
Credentials
The skill routes some queries to API models (Claude Sonnet/Opus) which would normally require API keys or credentials, but requires.env is empty and no primaryEnv is declared. Conversely, 'node' and access to /Users/thibaut/clawd are assumed but not declared as required. Requiring API access without declaring credentials and assuming user‑specific file paths are both disproportionate/undeclared.
Persistence & Privilege
The skill does not request always:true and is user‑invocable only; it does not try to modify other skills or system settings. The only persistence implication is the SKILL.md note that local models 'remain loaded in memory' — this is a behavioral description but not enforced by the package itself. Still, the wrapper hands execution to a local script, which could persist behavior depending on that script's contents.
What to consider before installing
This skill has several mismatches you should resolve before trusting or installing it:
- Ask the author to provide the missing auto-router.js source (the SKILL.md and wrapper reference /Users/thibaut/clawd/auto-router.js but that file is not included). Review that file's code for network calls, credential handling, and file I/O.
- Confirm whether 'node' is required on your agent and whether running a user‑home path is intentional. The provided router-integration.sh execs 'node auto-router.js' from /Users/thibaut/clawd — running that will execute arbitrary local code if present.
- Require explicit declaration of API credentials for any external models (Claude Sonnet/Opus). Do not supply API keys until you can audit where and how they are used.
- Verify how local models are installed and loaded; running local LLMs requires substantial resources and additional binaries/config that are not provided here.
If you cannot obtain and audit the missing auto-router.js and confirm intended credential usage and file paths, treat this skill as risky and avoid enabling it on agents with access to sensitive credentials or systems.Like a lobster shell, security has layers — review code before you run it.
latestvk9770ysjgy4j5wjjhwrbvwkrgd822n90
License
MIT-0
Free to use, modify, and redistribute. No attribution required.