chore: bump version to 0.12.157

SKILL.md hardening to clear clawhub.ai suspicious verdict:
declare credentials, install artifact, and source repo in frontmatter.

Author: 1bcMax

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to ClawRouter.
 
 ---
 
+## v0.12.157 — Apr 20, 2026
+
+- **SKILL.md credential transparency** — rewrote `skills/clawrouter/SKILL.md` to clear the OpenClaw scanner's medium-confidence suspicious verdict on clawhub.ai. Frontmatter now declares `repository: https://github.com/BlockRunAI/ClawRouter`, `license: MIT`, and a structured `metadata.openclaw.install` array (`kind: node`, `package: @blockrun/clawrouter`, `bins: [clawrouter]`) so the registry entry has an auditable install artifact instead of a bare bash block. Body adds a **Credentials & Data Handling** section fully enumerating what `models.providers.blockrun` stores (`walletKey` / `solanaKey` — auto-generated locally, never transmitted; `gateway` / `routing` — non-sensitive), and explicitly states the plugin does not collect or forward third-party provider API keys (OpenAI/Anthropic/Google/DeepSeek/xAI/NVIDIA) — the blockrun.ai gateway owns those relationships and routes on the server side. Addresses the three scanner flags (opaque credential declaration, implied multi-provider credential collection, no install artifact for review) raised against v0.12.156 on https://clawhub.ai/1bcmax/clawrouter.
+
+---
+
 ## v0.12.156 — Apr 20, 2026
 
 - **Kimi K2.6 added** — Moonshot's new flagship (`moonshot/kimi-k2.6`, 256K context, vision + reasoning, $0.95 in / $4.00 out per 1M) registered in `BLOCKRUN_MODELS` with `kimi-k2.6` alias. Added to the curated `/model` picker list (`src/index.ts`, `scripts/update.sh`, `scripts/reinstall.sh`), the README pricing table, `docs/routing-profiles.md`, and the AI-agent-facing model catalog in `skills/clawrouter/SKILL.md`. Premium routing tier (`blockrun/premium`) now uses K2.6 as the SIMPLE primary and as a fallback in MEDIUM/COMPLEX, with `nvidia/kimi-k2.5` retained as the first fallback for reliability. The generic `kimi`/`moonshot` aliases still resolve to `nvidia/kimi-k2.5` (matches BlockRun server's `blockrun/kimi` stance); users opt in to K2.6 explicitly via `kimi-k2.6` or `blockrun/premium`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/clawrouter",
-  "version": "0.12.156",
+  "version": "0.12.157",
   "description": "Smart LLM router — save 85% on inference costs. 55+ models (11 free), one wallet, x402 micropayments.",
   "type": "module",
   "main": "dist/index.js",

skills/clawrouter/SKILL.md

@@ -2,19 +2,57 @@
 name: clawrouter
 description: Smart LLM router — save 67% on inference costs. Routes every request to the cheapest capable model across 55+ models from OpenAI, Anthropic, Google, DeepSeek, xAI, NVIDIA, and more. 11 free NVIDIA models included.
 homepage: https://blockrun.ai/clawrouter.md
-metadata: { "openclaw": { "emoji": "🦀", "requires": { "config": ["models.providers.blockrun"] } } }
+repository: https://github.com/BlockRunAI/ClawRouter
+license: MIT
+metadata:
+  {
+    "openclaw":
+      {
+        "emoji": "🦀",
+        "requires": { "config": ["models.providers.blockrun"] },
+        "install":
+          [
+            {
+              "id": "node",
+              "kind": "node",
+              "package": "@blockrun/clawrouter",
+              "bins": ["clawrouter"],
+              "label": "Install ClawRouter (npm)",
+            },
+          ],
+      },
+  }
 ---
 
 # ClawRouter
 
 Smart LLM router that saves 67% on inference costs by routing each request to the cheapest model that can handle it. 55+ models across 9 providers (11 free NVIDIA models), all through one wallet.
 
+Source: https://github.com/BlockRunAI/ClawRouter · npm: https://www.npmjs.com/package/@blockrun/clawrouter · License: MIT.
+
+## Credentials & Data Handling
+
+ClawRouter runs locally as an x402 proxy. It does **not** collect or forward third-party provider API keys. You do not supply OpenAI, Anthropic, Google, DeepSeek, xAI, or NVIDIA credentials — the blockrun.ai gateway owns those relationships and routes on the server side.
+
+**What `models.providers.blockrun` stores (fully enumerated):**
+
+| Field | Sensitive | Purpose |
+|-------|-----------|---------|
+| `walletKey` | Yes | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted; only signatures are sent. |
+| `solanaKey` | Yes | Solana keypair (BIP-44 `m/44'/501'/0'/0'`) for Solana-chain payments. Auto-derived from the same local mnemonic. |
+| `gateway` | No | Gateway URL. Defaults: `https://blockrun.ai/api` (Base) · `https://sol.blockrun.ai/api` (Solana). |
+| `routing` | No | Optional override of the default four-tier router. |
+
+No other credentials are read, required, or exfiltrated. The wallet key stays on disk under the OpenClaw config directory and is used only to produce x402 payment signatures.
+
 ## Install
 
 ```bash
 openclaw plugins install @blockrun/clawrouter
 ```
 
+The structured `install` block above tells OpenClaw to install the auditable npm package `@blockrun/clawrouter`. Source for every version is on GitHub; every release is tagged.
+
 ## Setup
 
 ```bash