Skills Provider Management
📦

Provider Management

v2.0.0 Content revision r1 High Risk ⚙️ External commands📁 Filesystem access

Manage AI Provider Fallbacks

Managing providers, auth methods, and usage limits can be complex across Claude, Codex, Claude Code, and other tools. This skill documents commands for provider priority, credentials, model mappings, limits, status checks, and fallback behavior.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "Provider Management" from https://skillstore.io/skills/attendantlion8-provider-management.md and its manifest at https://skillstore.io/api/skills/attendantlion8-provider-management/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/attendantlion8-provider-management.md Signed manifest GET /api/skills/attendantlion8-provider-management/manifest Signed lockfile GET /api/skills/attendantlion8-provider-management/lockfile

Test it

Using "Provider Management". Review my current provider setup.

Expected outcome:

  • Anthropic subscription is the primary provider for Claude models.
  • OpenAI API access is available as a fallback for GPT models.
  • Google OAuth should be refreshed before it is used for Gemini models.

Using "Provider Management". Recommend a fallback order for reliability.

Expected outcome:

  • Use subscription providers first because they have the highest priority.
  • Use OAuth providers second for personal account coverage.
  • Keep API key providers as controlled fallback options with usage limits.

Security Audit

High Risk
v10 • 7/18/2026 Open versioned report

All 40 command findings are false positives caused by Markdown backticks, code fences, model names, and documented slash-command examples. Hidden configuration storage and token-validation prose are contextual, not hidden execution or reconnaissance. However, inline secret arguments and reusable subscription session tokens create credible credential exposure and account-security risks.

1
Files scanned
218
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:64-71SKILL.md:178-183SKILL.md:203-208
Credentials Exposed Through Inline Command Arguments
Examples place API keys and session tokens in --key arguments. These secrets may persist in chat transcripts, logs, or process metadata.
Explicit --key examples show secrets entered inline, although the underlying slash-command implementation is unavailable.
High
SKILL.md:15-19SKILL.md:70-71SKILL.md:203-208
Consumer Session Tokens Used as Provider Credentials
The skill treats subscription session tokens as reusable provider credentials. This can expose accounts and bypass provider-approved OAuth or API boundaries.
Subscription authentication and session-token setup are explicit, but provider policy compliance cannot be verified from the documentation.

Risk Factors

⚙️ External commands (40)
SKILL.md:24 SKILL.md:28 SKILL.md:32 SKILL.md:36 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:56 SKILL.md:60-72 SKILL.md:72-74 SKILL.md:74-78 SKILL.md:78-90 SKILL.md:90-92 SKILL.md:92-96 SKILL.md:96-100 SKILL.md:100-102 SKILL.md:102-106 SKILL.md:106-109 SKILL.md:109-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-121 SKILL.md:121-125 SKILL.md:125-128 SKILL.md:128-132 SKILL.md:132-138 SKILL.md:138-142 SKILL.md:142-150 SKILL.md:150-156 SKILL.md:156-164 SKILL.md:164-178 SKILL.md:178-185 SKILL.md:185-199 SKILL.md:199-201 SKILL.md:201-206 SKILL.md:206-208 SKILL.md:208-213 SKILL.md:213-215
📁 Filesystem access (2)
SKILL.md:133 SKILL.md:133
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/attendantlion8-provider-management/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/attendantlion8-provider-management/security.svg)](https://skillstore.io/skills/attendantlion8-provider-management?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/attendantlion8-provider-management?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/attendantlion8-provider-management/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/attendantlion8-provider-management.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

AttendantLion8. (2026). Provider Management security audit report (audit version 10) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/attendantlion8-provider-management/audits/10

BibTeX citation

@techreport{attendantlion8-attendantlion8-provider-management-2026, author = {AttendantLion8}, title = {Provider Management security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/attendantlion8-provider-management/audits/10}, note = {Author version 2.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "Provider Management security audit report (audit version 10)" version: "2.0.0" type: report authors: - name: "AttendantLion8" date-released: "2026-07-18" url: "https://skillstore.io/skills/attendantlion8-provider-management/audits/10" identifiers: - type: other value: "skillstore:attendantlion8-provider-management:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
71
Community
74
Spec Compliance

What You Can Build

Standardize Model Provider Setup

Configure a shared provider order and authentication strategy for teams using several AI model vendors.

Control AI Usage Budgets

Set daily and monthly provider limits so model usage stays within planned budget boundaries.

Improve Model Reliability

Use fallback providers and manual switching when a primary provider is unavailable or rate limited.

Try These Prompts

Check Provider Status 
Show the status of every configured provider and explain which provider will be used first.
Set Provider Priority 
Help me prioritize subscription access first, OAuth second, and API keys only as fallback providers.
Plan Usage Limits 
Recommend daily and monthly provider limits for a team that wants reliable fallback without overspending.
Design Multi-Vendor Fallback 
Create a provider strategy across Anthropic, OpenAI, Google, and OpenRouter with auth priority, limits, and failover rules.

Best Practices

  • Use scoped credentials and avoid broad account tokens when provider APIs offer safer alternatives.
  • Set conservative daily and monthly limits before enabling automatic provider switching.
  • Review provider status after adding credentials or changing priority rules.

Avoid

  • Do not paste subscription or session tokens into shared terminals or logs.
  • Do not rely on a single provider for critical model workflows.
  • Do not leave outdated provider IDs in routing rules after vendors rename models.

Frequently Asked Questions

What does this skill manage?
It documents provider authentication, model mappings, priority order, usage limits, status checks, and fallback behavior.
Which tools does it support?
The report lists support for Claude, Codex, and Claude Code compatible environments.
Does it include executable commands?
No executable implementation is present in the package. The skill file documents command patterns and workflows.
Can it store API keys or OAuth tokens?
The documentation describes local credential and token files, so users should treat this skill as sensitive.
How does provider priority work?
It prefers subscription access first, OAuth second, and direct API keys as the lowest priority fallback.
What should I verify before publishing?
Verify secure credential storage, token redaction, permission enforcement, and token removal instructions.

Developer Details

License

MIT

Author version

v2.0.0

Skillstore revision

r1

Repository

https://github.com/AttendantLion8/provider-fallback-plugin/tree/master/skills/provider-management

Ref

1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef

Maintenance freshness

7/18/2026

Usage

7 downloads · 245 views

File structure

📄 SKILL.md