OpenClaw Model Router Skill

ReviewAudited by ClawScan on May 1, 2026.

Overview

The artifacts match a disclosed model-routing skill, but it can change which OpenClaw model is active, so users should review its local configuration before use.

Install only if you want this skill to control OpenClaw model selection. Review the model map, schedule rules, log/lock paths, and local OpenClaw CLI configuration before use, and avoid installing generated cron entries unless you intentionally want recurring automatic switches.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can switch future OpenClaw work to a different model/provider, affecting behavior, cost, and provider data handling.

Why it was flagged

The skill invokes a configured local CLI to set the active model. This is the core disclosed purpose, but it is still a high-impact tool action because it changes agent behavior.

Skill content
const args = [...setArgsPrefix, targetModel];
const res = await runCommand(binary, args, { timeoutMs: config.timeoutMs || 20000 });
Recommendation

Review router.config.json and router.schedule.json before use, and only allow trusted users or workflows to run schedule apply/end or change the configured controller binary.

What this means

If configured to use authenticated OpenClaw access, model switches run with the privileges available in the user's environment.

Why it was flagged

The controller can require auth-related environment variables and passes the process environment to the OpenClaw CLI. The default config requires none, and this is expected for CLI-based account access.

Skill content
const missing = requiredEnv.filter((k) => !process.env[k]);
...
env: process.env
Recommendation

Use least-privileged OpenClaw credentials where possible and avoid running the skill with unnecessary sensitive environment variables.

What this means

Automated installers or users may not be warned up front that the skill depends on local tooling and has limited source provenance metadata.

Why it was flagged

The registry metadata does not provide source/homepage provenance or declare runtime binaries, even though the artifacts document Node commands and an OpenClaw CLI controller.

Skill content
Source: unknown
Homepage: none
Required binaries (all must exist): none
No install spec — this is an instruction-only skill.
Recommendation

Verify the package origin and local OpenClaw CLI before installing, and maintainers should declare the Node/OpenClaw runtime expectations in metadata.

What this means

If the generated cron entries are installed, model switching can continue automatically on a schedule.

Why it was flagged

The skill can help create recurring scheduled model switches, but the artifact describes this as a manual preview/install step rather than hidden persistence.

Skill content
Generate cron preview (manual install):

```bash
node src/cli.js schedule cron
```
Recommendation

Only install generated cron entries intentionally, review the schedule rules first, and remove the cron entries when scheduled switching is no longer desired.