Model Intel Pro

Live LLM model pricing and capabilities from OpenRouter. List top models, search by name, compare side-by-side, find best model for a use case, check pricing...

This skill appears to implement the advertised model-intel functionality (it fetches model data from openrouter.ai and prints comparisons), but there are a couple of red flags: 1) it declares OPENROUTER_API_KEY but the HTTP requests do not use the key (no Authorization header or API param), and 2) the script will try to read ~/.openclaw/workspace/.env for the key even though the manifest lists no required config paths. These could be harmless (a bug or unfinished code) but could also mean the author intended to use the key or access workspace config in ways not declared. Before installing: review the script yourself (it’s short), run it in an isolated environment or sandbox, and avoid exposing a real API key until you confirm where it is sent. Prefer setting the env var only for ephemeral sessions, or remove the key from your home .env if you don’t want it read. If you need higher assurance, ask the publisher to explain why the key is declared but not used and to remove the fallback file read or declare it explicitly.

Type: OpenClaw Skill Name: model-intel-pro Version: 1.0.0 The skill is classified as suspicious due to its method of retrieving the `OPENROUTER_API_KEY`. While it first checks environment variables as declared in `SKILL.md`, it then attempts to read the `~/.openclaw/workspace/.env` file directly if the environment variable is not found. This direct file access for secrets, even if scoped to its own key, is a less secure practice than relying solely on environment variables and introduces a potential vulnerability in secrets management within the OpenClaw workspace, as it could expose other secrets if the `.env` file is not carefully managed or if the parsing logic were less specific. No other malicious behaviors like data exfiltration, command injection, or persistence mechanisms were found.