Freeride Opencode

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:18 PM UTC
• Version: 1.2.0

Overview

This is a documentation-only skill for configuring free OpenCode/OpenRouter model fallbacks, with the main risk being persistent model-routing changes and third-party provider data exposure.

Before installing or applying the examples, confirm you are comfortable routing model requests through OpenCode Zen and OpenRouter, and review your current OpenClaw configuration because the provided commands change persistent default model, fallback, heartbeat, and subagent settings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Steps

### Step 1: Update SKILL.md
- [ ] Bump version from 1.0.0 to 1.1.0
- [ ] Add Trinity Large to Quick Start JSON example
- [ ] Add Trinity Large to Model Selection Guide table

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

## Task Checklist

### Phase 1: Update SKILL.md
- [ ] **T1.1**: Update version header: `version: 1.1.0`
- [ ] **T1.2**: Update Quick Start JSON example with new fallback
- [ ] **T1.3**: Add Trinity Large to Model Selection Guide table

• Confidence: 93% confidence
• Finding: The task explicitly instructs modification of SKILL.md, which is the skill's primary instruction surface. Self-modification is risky because an agent following this task could rewrite its own behavior or safety-relevant guidance, creating a pathway for persistence, instruction tampering, or future unsafe execution even though the stated change here appears documentation-oriented.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to supply API keys for external model providers but does not warn that prompts, files, and other data may be transmitted to third-party services. In a skill specifically designed for model routing and automatic fallback, this omission is more dangerous because requests may be silently sent to multiple providers, expanding data exposure and compliance risk.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

5. opencode/gpt-5-nano

### Files Modified
- `/root/.openclaw/workspace/skills/freeride-opencode/SKILL.md`
- `/root/.openclaw/workspace/skills/freeride-opencode/references/models.md`
- `/root/.openclaw/workspace/skills/freeride-opencode/references/templates.md`

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The user-facing instructions and descriptions are presented in Portuguese, and the file does not indicate that this language choice is optional or region-specific. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The example provides a direct configuration-modifying command that patches OpenClaw settings without any warning, backup step, or explanation that existing defaults may be overwritten. While not code execution or data exfiltration, it can cause unintended persistent configuration changes and user confusion if copied verbatim.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This migration example tells users to switch model configuration and fallback chains but does not warn that existing model settings may be replaced. In context, this is a documentation safety issue: users following the example may unintentionally lose prior routing or fallback preferences, especially during migration from another provider.