OpenRouter Analytics

Review OpenRouter usage, analytics, and troubleshooting data via API. Use when the user asks for spend/usage monitoring, activity trends, per-key management...

Before installing or running: (1) Recognize that the script requires two OpenRouter keys (OPENROUTER_MANAGEMENT_KEY and OPENROUTER_API_KEY) even though the registry metadata lists none — confirm you are comfortable providing those. (2) The script auto-loads ~/.openclaw/.env and ./.env; inspect those files for other secrets before running or move keys to a dedicated env file. (3) Review the full script (included) for any network endpoints or unexpected behavior (the visible code calls https://openrouter.ai/api/v1). (4) Run the script in an isolated environment (or with test keys) if you’re unsure about the source, and ask the publisher to update the package metadata to declare required env vars and config paths for transparency. (5) If you want higher assurance, request or verify an official homepage or trusted publisher identity before trusting management-level keys.

Type: OpenClaw Skill Name: openrouter-analytics Version: 1.0.0 The skill is classified as suspicious due to a potential arbitrary file write vulnerability in `scripts/openrouter_analytics.py`. The `cmd_activity` function allows writing activity data to a CSV file specified by the `--csv` argument. While the script itself does not construct a malicious path, a compromised or malicious AI agent could be prompted to provide a sensitive file path (e.g., `/etc/passwd`, `~/.ssh/authorized_keys`) to this argument, leading to unauthorized file modification or data corruption. All network communication is confined to `https://openrouter.ai/api/v1`, and there are no other signs of malicious intent like data exfiltration to unauthorized endpoints, obfuscation, or direct shell command injection within the script's logic or `SKILL.md`.