Skill Orchestra

Skill-aware agent routing with explicit competence/cost modeling. +22.5% accuracy, 700x cheaper than RL routers. Based on arXiv:2602.19672.

This package appears to implement what it claims: local routing logic with no credential or network demands. Before installing: (1) confirm whether your platform provides the referenced 'model-router' skill or whether SKILL.md's dependency needs to be added (there is a mismatch with registry metadata), (2) review the included files for any unexpected network calls or os/env access (importing the module will execute its top-level code), and (3) if you plan to run it in production, test in a sandboxed environment first. If the publisher/source is unknown, prefer running in an isolated environment and ask the author for a public repo or homepage to increase transparency.

Type: OpenClaw Skill Name: skill-orchestra Version: 2.0.0 The skill's core purpose is benign: intelligent routing of tasks to other skills. However, the `SKILL.md` documentation includes PowerShell code examples (`Invoke-SkillDemandInference`) that use regex matching on a `$Context` parameter. If an AI agent were to implement this logic directly and pass unsanitized user input as `$Context`, it could introduce a regex injection vulnerability. While the provided Python implementation (`skill_orchestra.py`) uses simple string matching and not regex for task analysis, the presence of this pattern in the agent's instructions (SKILL.md) constitutes a potential vulnerability that could be exploited via prompt injection against the agent, leading to resource exhaustion or other regex-related issues. This is a design flaw or vulnerability, not clear malicious intent.