Caveat verdict
add-top-openrouter-models
The skill syncs OpenRouter models used by OpenClaw into this installation's config. It verifies model IDs against the API catalog and adds missing models with correct specs and aliases. The content does not show real malicious execution.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (4)
Pipe to python — executes piped content as Python code
scripts/sync-openrouter-models.py · prose · downgraded · | python3
Accesses OpenClaw config/secrets directly
SKILL.md · prose · downgraded · ~/.openclaw/openclaw.json
Python urllib.request — network access
scripts/sync-openrouter-models.py · prose · downgraded · urllib.request
Python os.environ.get — reads environment variable
scripts/sync-openrouter-models.py · prose · downgraded · os.environ.get(
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.