OpenCode Free Models

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it can automatically change persistent OpenClaw/QClaw model configuration based on remote data without a clear confirmation or backup step.

Review before installing. Use this only when you specifically want opencode.ai free models added to OpenClaw/QClaw, and back up your existing OpenClaw/QClaw config first. Prefer running it only after an explicit confirmation step, because it changes future model-provider settings in your local agent configuration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly states that the skill will fetch data from an external service and modify local configuration files automatically, but it does not provide any warning, confirmation step, backup guidance, or explanation of the local side effects. This is dangerous because users may trigger network access and persistent configuration changes without informed consent, which can overwrite settings, introduce untrusted endpoints, or weaken security assumptions by inserting a shared/public API key.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill performs network access and reads/writes user configuration files, but it declares no explicit tool scope or permission boundaries. That makes the skill capable of silently modifying persistent local settings based on remote data, increasing the risk of unauthorized config changes, supply-chain style abuse, or accidental damage if invoked by an agent runtime with broad default permissions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation conditions use broad user-need language like needing a free AI model or mentioning generic terms, without clearly restricting execution to users who want this specific provider configured. In context, this is more dangerous because the skill not only provides information but also fetches remote data and writes to persistent config files, so ambiguous activation can lead to unintended side effects.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase includes very broad terms like "opencode 免费" and especially "free model," which may match unrelated user requests and cause the skill to activate unexpectedly. Because the skill can perform network access and persistent file writes, overly broad activation increases the chance of unintended configuration changes without sufficiently specific user intent.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The README's primary instructional content uses Chinese only, which can impose a language constraint on users without opt-in or justification. Under the policy rule, forcing a specific language without offering alternatives or documenting a region-specific purpose is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The module description is written in Chinese, and the script's user-facing output throughout the file is also Chinese-only. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the language-policy concern for natural-language policy violations.

Static analysis

No suspicious patterns detected.