Skills/ClawHub/free-model-router-v1

free-model-router-v1@2.2.0

BLOCKED· startup only

Publisher claims: "为 OpenClaw 提供免费模型智能路由服务，支持本地代理、自动配置、自动轮询、故障切换和配置零侵入。在需要设置免费模型路由、配置 Provider、切换模型或诊断模型可用性问题时使用。" Observed in sandbox: sends data to freemodel.eu.org, freemodel.dpdns.org, model-server.codebot.workers.dev.

Registry ClawHubPublisher laodao-agent · publishing for 94 daysInstalls 2,494Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 47/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: document.cookie access; Pipe-to-shell pattern. Summary: sends data to freemodel.eu.org, freemodel.dpdns.org, model-server.codebot.workers.dev.

Behavior trace

Honeypot run · 21 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.9sprocessdependency install exit 0
21sfilesystemread ~/.free-model-router/data/router-config.json · ~/.free-model-router/data · ~/.free-model-router/data/device-id.json · ~/.free-model-router/data/events.json outside project
21sfilesystemwrote ~/.free-model-router/data/router-config.json · ~/.free-model-router/data/router-config.json.bak-1794227286496 · ~/.free-model-router/data/router-config.json.tmp · ~/.free-model-router/data/router.pid · ~/.free-model-router/data/device-id.json · ~/.free-model-router/logs/server-client.log
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.eu.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://freemodel.dpdns.org:443 · not in the allow-list, refused
21snetworkCONNECT tcp://model-server.codebot.workers.dev:443 · not in the allow-list, refused
21sclaimedstartup only: exited (0) before answering · [router] 2026-11-09T12:28:14.558Z 定时任务已启动 [config] 2026-11-09T12:28:14.760Z 配置热更新 [route-engine] 2026-11-09T12:28:14.760Z 轮询列表重建: 0 个可用 provider () [route-engine] 2026-11-09T12:28:14.761Z 路由策略已初始化: sticky
21sprocessscript backend runs setup only
21sprocessno install scripts to re-run

Static findings

HIGH
document.cookie accesscore/admin/public/js/admin.js:1 · document.cookie access — can steal session cookies…ndow.location.href="/admin/login.html",!1}return!0}function _syncAdminCookie(e){document.cookie="admin_token="+e+";path=/;max-age=604800;SameSite=Strict"}function _clearAdminC…Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actioncore/anthropic-transform.js:1 · File type combined with upload action — agent may exfiltrate local data filesconst LOG_PREFIX="[anthropic-transform]";function log(...t){console.log(`${LOG_PREFIX} ${(new Date).toISOString()}`,...t)}function _isValidToolName(t){return"string"==typeof t&&t.trim().length>0}function _convertSystemToOpenAI(t){if(t){if("…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Remote installer piped to shellcore/admin/public/js/admin.js:1 · Remote installer piped to shell…int");n&&(n.textContent="自动更新失败，您也可以在服务器终端手动执行以下命令完成升级："),e&&t&&(t.textContent="curl -sSL https://freemodel.eu.org/install.sh | bash -s -- --force",e.style.display="block")}},startStatusPolling(){this.stopStatusP…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actioncore/admin/public/js/admin.js:1 · File type combined with upload action — agent may exfiltrate local data files…}async function initAuth(){try{const e=await fetch("/api/auth/status"),t=await e.json();if(t.success&&t.data.isLocalAccess)return _isLocalAccess=!0,void initApp()}catch(e){console.warn("[Admin] 无法获取认证状态，使用默认检查")}await _checkTokenAndRedirec…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
CRITICAL
Pipe-to-shell patterncore/admin/public/js/admin.js:1 · Pipe-to-shell pattern — downloads and immediately executes remote code…int");n&&(n.textContent="自动更新失败，您也可以在服务器终端手动执行以下命令完成升级："),e&&t&&(t.textContent="curl -sSL https://freemodel.eu.org/install.sh | bash -s -- --force",e.style.display="block")}},startStatusPolling(){this.stopStatusP…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actioncore/routing-strategy.js:1 · File type combined with upload action — agent may exfiltrate local data files…e("./context-window"),LOG_PREFIX="[routing-strategy]";function log(...e){console.log(`${LOG_PREFIX} ${(new Date).toISOString()}`,...e)}const _strategyRegistry={};function registerStrategy(e,t){_strategyRegistry[e]=t}function createStrategy…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/server-client.js:1 · File type combined with upload action — agent may exfiltrate local data files…(path.dirname(config.DATA_DIR),"logs"),LOG_FILE=path.join(LOG_DIR,"server-client.log");function _writeLogFile(e,t){try{fs.existsSync(LOG_DIR)||fs.mkdirSync(LOG_DIR,{recursive:!0});const n=(new Date).toISOString()+` [${e}] ${LOG_PREFIX} `;f…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/notifications.js:1 · File type combined with upload action — agent may exfiltrate local data files…nfig=require("./config"),LOG_PREFIX="[notifications]";function log(...e){console.log(`${LOG_PREFIX} ${(new Date).toISOString()}`,...e)}const ALLOWED_ANNOUNCE_DOMAINS=["freemodel.eu.org","freemodel.dpdns.org"];function isAllowedAnnounceUrl(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/proxy.js:1 · File type combined with upload action — agent may exfiltrate local data files…ction _debug(...e){config.isDebugLogEnabled&&config.isDebugLogEnabled()&&console.log(`[proxy] [DEBUG] ${(new Date).toISOString()}`,...e)}function _trace(e,t={}){monitorLogger.trace("proxy",e,t)}function _classifyHttpError(e,t=""){if(/conte…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/probe-service.js:1 · File type combined with upload action — agent may exfiltrate local data files…n require("./config")}const LOG_PREFIX="[probe]",MODEL_STATES_FILE="model-states.json",MODEL_STATES_VERSION=4;function log(...e){console.log(`[probe] ${(new Date).toISOString()}`,...e)}const SHADOW_PROBE_CONFIG={maxCallsPerModel:3,minSucce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/monitor-logger.js:1 · File type combined with upload action — agent may exfiltrate local data files…=10,MAX_LOG_AGE_DAYS=7;let _fmrVersion="unknown";try{const e=require("../package.json");_fmrVersion=e.version||"unknown"}catch(e){}const LOG_LEVELS={ERROR:0,WARN:1,INFO:2,DEBUG:3,TRACE:4},KNOWN_ERROR_PATTERNS=[{pattern:/rate limit|too many…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/server.js:1 · File type combined with upload action — agent may exfiltrate local data files…,LOG_PREFIX="[router]";let _fmrVersion="unknown";try{const e=require("../package.json");_fmrVersion=e.version||"unknown"}catch(e){}function _getSyncProviderIds(e){return Object.entries(e.providers||{}).filter(([e,r])=>!r.deleted).map(([e])…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/route-engine.js:1 · File type combined with upload action — agent may exfiltrate local data files…require("./provider-ids"),LOG_PREFIX="[route-engine]";function log(...e){console.log(`${LOG_PREFIX} ${(new Date).toISOString()}`,...e)}function _debug(...e){config.isDebugLogEnabled&&config.isDebugLogEnabled()&&console.log(`${LOG_PREFIX} […Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/stats.js:1 · File type combined with upload action — agent may exfiltrate local data files…foldProviderId}=require("./provider-ids"),LOG_PREFIX="[stats]",STATS_FILE="stats.json",EWMA_ALPHA=.5,MAX_RECENT_CALLS=20,LATENCY_BUCKETS=[{label:"< 500ms",max:500},{label:"500ms-1s",max:1e3},{label:"1-2s",max:2e3},{label:"2-5s",max:5e3},{l…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/free-model-cli.js:1 · File type combined with upload action — agent may exfiltrate local data files…动超时")))},1e3)})}async function ensureRouter(){return isRouterRunning()||(console.log("Router 未运行，正在启动..."),await startRouter()),!0}async function cmdHelp(){console.log("\nfree-model-cli — 免费模型智能路由 CLI\n\n用法：node free-model-cli.js <command>…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/config.js:1 · File type combined with upload action — agent may exfiltrate local data files…ata"),CONFIG_FILE=process.env.FMR_CONFIG_PATH||path.join(DATA_DIR,"router-config.json"),MAX_BACKUPS=3,LOG_PREFIX="[config]";let _config=null;const _watchCallbacks=[];let _watcher=null,_debounceTimer=null,_watchPaused=!1;const KNOWN_PROVIDE…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/health-check.js:1 · File type combined with upload action — agent may exfiltrate local data files…k]",MAX_CHECK_MODELS=20,DELAY_BETWEEN_REQUESTS_MS=500;function log(...e){console.log(`${LOG_PREFIX} ${(new Date).toISOString()}`,...e)}function _getHealthCheckTimeouts(){const e=config.get(),t=e.routing&&e.routing.healthCheckTimeouts||{};r…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈1,620 tok
1 file · 51 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

33 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim laodao-agent: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim laodao-agentPropose a patch to the maintainer
free-model-router-v1@2.2.0 safety verdict: Blocked (startup only) — KillerSkills