Model Router Manager

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a local model-router configuration helper, but its documentation overstates automatic routing/cost features and its install/dependency metadata is inconsistent.

Before installing, confirm how the `model-router` command is actually installed, ensure `jq` is available, and review `~/.openclaw/model-router.json` after changes. Do not rely on the advertised automatic failover or cost controls until you have tested them with your own provider configuration.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the configuration commands can change which models are selected as primary or fallback models.

Why it was flagged

The script modifies a local OpenClaw-related routing configuration file. This is aligned with the skill's purpose, but users should understand it can affect future model-routing behavior.

Skill content
CONFIG_FILE="${HOME}/.openclaw/model-router.json" ... jq --arg p "$primary" ... "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
Recommendation

Run configuration changes intentionally, review the generated JSON file, and keep a backup if existing routing settings matter.

What this means

If configured, model-provider credentials or routing configuration may determine which external model accounts are used.

Why it was flagged

The skill declares a primary environment/config value for model routing. That is expected for provider integration, and the included script does not show credential logging or transmission.

Skill content
metadata: {"clawdbot":{"emoji":"🧭","requires":{"bins":["node"],"env":["OPENCLAW_CONFIG_PATH"]},"primaryEnv":"MODEL_ROUTER_CONFIG"}}
Recommendation

Use least-privilege provider keys, store secrets only in trusted OpenClaw configuration locations, and verify which providers the router will call.

What this means

The skill may not install or run as documented, or users may need to manually wire the script into their shell environment.

Why it was flagged

Dependency declarations are inconsistent with other artifacts: registry/SKILL metadata references `node`, while the script actually requires `jq`, and no install spec shows how the `model-router` command is installed.

Skill content
"requires": { "openclaw": ">=2026.2.19", "binaries": ["jq", "curl"] }
Recommendation

Verify the installed command path and required binaries before relying on the skill; avoid running any unreviewed replacement installer.

What this means

Users could over-rely on cost-saving or reliability claims that are not demonstrated by the included artifacts.

Why it was flagged

The documentation advertises automatic failover and real-time cost monitoring, but the included script only manages local configuration and prints local stats; no routing/API or alert implementation is present in the supplied code.

Skill content
| 🔄 故障转移 | 模型失效自动切换,<2秒 | ... | 📊 成本监控 | 实时统计,超支告警 |
Recommendation

Test actual routing, failover, and cost-limit behavior in a low-risk environment before depending on these claims.