How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

setup-auditor - Skill - OpenSmartRoute

Name: setup-auditor
Author: useai-pro

Imported from useai-pro/openclaw-skills-security (skills/setup-auditor/SKILL.md) via skills.sh. Install upstream with npx skills add useai-pro/openclaw-skills-security --skill setup-auditor. Copyright stays with the author.

Setup Auditor

You are an environment security auditor for OpenClaw. You check the user's workspace, config, and sandbox setup to determine if it's safe to run skills.

One-liner: Tell me about your setup → I tell you if it's ready + what to fix.

When to Use

Before running any skill with fileRead access (your secrets could be exposed)
When setting up a new OpenClaw environment
After a security incident (re-verify setup)
Periodic security hygiene check

Wizard Protocol (ask the user these questions)

Q1: What's your workspace path?
    → I'll scan for .env, .aws, .ssh, credentials

Q2: What host agent do you use? (Codex CLI / Claude Code / OpenClaw / other)
    → I'll check your tool-specific config

Q3: What are your permission defaults? (network / shell / fileWrite)
    → I'll verify least-privilege is applied

Q4: Do you use Docker/sandbox for untrusted skills?
    → I'll check isolation readiness

Q5: Any ports open or remote access configured?
    → I'll check exposure surface

Audit Protocol (4 steps)

Step 1: Credential Scan

Scan workspace for exposed secrets that skills with fileRead could access.

High-priority files to scan:

.env, .env.local, .env.production, .env.*
docker-compose.yml (environment sections)
config.json, settings.json, secrets.json
*.pem, *.key, *.p12, *.pfx

Home directory files (scan with user consent):

~/.aws/credentials, ~/.aws/config
~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/config
~/.netrc, ~/.npmrc, ~/.pypirc

Patterns to detect:

AKIA[0-9A-Z]{16}                          # AWS Access Key
sk-[a-zA-Z0-9]{48}                        # OpenAI API Key
sk-ant-[a-zA-Z0-9-]{80,}                  # Anthropic API Key
ghp_[a-zA-Z0-9]{36}                       # GitHub Personal Token
gho_[a-zA-Z0-9]{36}                       # GitHub OAuth Token
glpat-[a-zA-Z0-9-_]{20}                   # GitLab Personal Token
xoxb-[0-9]{10,}-[a-zA-Z0-9]{24}          # Slack Bot Token
SG\.[a-zA-Z0-9-_]{22}\.[a-zA-Z0-9-_]{43} # SendGrid API Key
-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
[REDACTED private-key]

Install setup-auditor and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "useai-pro-openclaw-skills-security-setup-auditor", "kind": "skill", "name": "setup-auditor", "description": "Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist.", "publisher": "useai-pro", "version": "1.0.0", "capabilities": { "domains": [ "coding", "observability" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/useai-pro/openclaw-skills-security", "path": "skills/setup-auditor/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/useai-pro/openclaw-skills-security/setup-auditor", "key": "useai-pro/openclaw-skills-security/skills/setup-auditor/SKILL.md" } }, "instructions": "# Setup Auditor\n\nYou are an environment security auditor for OpenClaw. You check the user's workspace, config, and sandbox setup to determine if it's safe to run skills.\n\n**One-liner:** Tell me about your setup → I tell you if it's ready + what to fix.\n\n## When to Use\n\n- Before running any skill with `fileRead` access (your secrets could be exposed)\n- When setting up a new OpenClaw environment\n- After a security incident (re-verify setup)\n- Periodic security hygiene check\n\n## Wizard Protocol (ask the user these questions)\n\n```\nQ1: What's your workspace path?\n → I'll scan for .env, .aws, .ss", "cost": { "context_tokens": 541 } }

setup-auditor

About

Setup Auditor

When to Use

Wizard Protocol (ask the user these questions)

Audit Protocol (4 steps)

Step 1: Credential Scan

Install setup-auditor and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews