ClawHub
Back to skill

Security audit

Freeride Opencode

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed configuration helper for routing OpenClaw model requests through OpenCode Zen and OpenRouter free-model fallbacks.

Before installing, confirm you are comfortable routing agent prompts to OpenCode Zen and OpenRouter, and only add API keys for providers you intend to use. Review any `openclaw config.patch` JSON before applying it because it will change your default model and fallback behavior persistently.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Low
Confidence
92% confidence
Finding
The example presents a configuration-changing command that directly patches OpenClaw settings without warning the user that it will persistently modify their local agent configuration. While not inherently malicious, this can lead to unintended changes, confusion, or accidental routing of future requests through different models than the user expects.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The migration example encourages switching model providers and fallback chains without clearly warning that future prompts and data may be sent to different external providers. In this skill's context, provider routing is the core functionality, so omission of a provider/data-handling warning increases the risk of unintentional data exposure or policy noncompliance.

Self-Modification

High
Category
Rogue Agent
Content
## Task Checklist

### Phase 1: Update SKILL.md
- [ ] **T1.1**: Update version header: `version: 1.1.0`
- [ ] **T1.2**: Update Quick Start JSON example with new fallback
- [ ] **T1.3**: Add Trinity Large to Model Selection Guide table
Confidence
97% confidence
Finding
Update SKILL

VirusTotal

No VirusTotal findings

View on VirusTotal