Operrouter Connect

Use this skill whenever the user wants to work with OpenRouter's free LLM models. Triggers include: any mention of "OpenRouter", "free models", "openrouter-c...

This skill mostly does what it says (find and proxy free OpenRouter models), but be aware of these issues before installing: - OPENROUTER_API_KEY is required at runtime (the registry metadata fails to declare it). Provide a dedicated, limited-scope key you trust and do not reuse high-value credentials. - The scripts load ./ .env, ~/.env and the process environment: if you run them in an environment with other secrets, those values will be visible to the process. Prefer running in a clean/sandboxed environment (or set only OPENROUTER_API_KEY) to avoid accidental exposure. - resolve_key.py prints a masked key fragment to stderr (some characters are shown). Expect that fragments may appear in logs or conversation history. - SKILL.md contains a hard-coded path (/home/claude/...) when invoking bundled scripts. Before running, update the commands to point to the skill's actual script locations or run them from the skill directory to avoid unexpected behavior. - The skill writes a cache file to /tmp; inspect that file if you have concerns about local storage. If you need higher assurance: ask the publisher to correct the registry metadata to declare OPENROUTER_API_KEY, remove hard-coded paths from SKILL.md, and explicitly document what env vars are read. Otherwise run the scripts manually in a controlled environment first to confirm behavior.

Type: OpenClaw Skill Name: openrouter-connect Version: 1.0.0 The openrouter-connect skill is designed to help users discover and interact with free LLM models on OpenRouter. It includes scripts (discover_models.py, proxy_query.py, resolve_key.py) that fetch model data from the official OpenRouter API and manage API keys stored in local or global .env files. While it accesses the user's home directory to look for a global .env file, this behavior is documented and consistent with the tool's purpose of managing API credentials. There is no evidence of data exfiltration to third parties, obfuscation, or malicious prompt injection.