OpenRouter Rankings Tracker

PassAudited by ClawScan on May 10, 2026.

Overview

The skill appears to fetch public OpenRouter rankings and optionally save reports locally, with a few setup and automation details users should notice.

This looks safe for fetching public OpenRouter rankings. Before installing, be aware that it needs Playwright/Chromium despite no install requirements being declared, and only enable the weekly cron/Feishu reporting example if you really want recurring automated reports.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may fail unless Playwright/Chromium is already available, and users should know which browser binary is being launched.

Why it was flagged

The script depends on Playwright/Chromium, including an environment-controlled or hardcoded browser path, while the registry says there are no required binaries, environment variables, or install spec. This is a setup/provenance gap rather than evidence of malicious behavior.

Skill content
const { chromium } = require('playwright'); ... executablePath: process.env.CHROMIUM_PATH || '/home/Admin/.cache/ms-playwright/chromium-1194/chrome-linux/chrome'
Recommendation

Install Playwright/Chromium from a trusted source if needed, and verify `CHROMIUM_PATH` points to the intended browser binary.

What this means

If the user installs the cron schedule, the agent may run weekly without a new manual request and may attempt to send the report to Feishu if configured.

Why it was flagged

The documentation includes a recurring cron-based agent turn. It is disclosed and purpose-aligned for weekly reports, but it is still autonomous recurring behavior that users should explicitly opt into.

Skill content
"schedule": { "kind": "cron", "expr": "0 9 * * 1" }, "payload": { "kind": "agentTurn", "message": "Fetch OpenRouter rankings and push to Feishu" }
Recommendation

Only enable the cron integration if recurring reports are desired, and confirm the intended Feishu destination and permissions before enabling any push workflow.