Free Models for OpenClaw and other Agents

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:58 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its model-discovery purpose, but it unnecessarily asks for an OpenRouter API key that the code does not actually use.

Review before installing if you are uncomfortable with unnecessary credential handling. The model lookup behavior is narrow and non-destructive, but users should not paste or export a real OpenRouter API key for this CLI unless the package is changed to need it and provides clear secret-handling guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ae1

High

• Category: analysis-evasion

Content

import { discoverFreeModels } from './scripts/free-models.js';

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

import { discoverFreeModels } from './scripts/free-models.js';

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

import { discoverFreeModels } from './scripts/free-models.js';

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

import { discoverFreeModels } from './scripts/free-models.js';

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

const models = await fetchAllModels();
  return models.filter((m) => {
    const promptPrice = parseFloat(m.pricing.prompt);
    return promptPrice === 0 || promptPrice < 0.0001;
  });
}

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill instructs users to place a live OpenRouter API key directly into an environment variable and shows a realistic key prefix, but provides no warning about keeping the credential secret, avoiding shell history leakage, or using scoped/rotated keys. While environment variables are a common mechanism for API auth, documentation that normalizes pasting secrets into commands without safe-handling guidance increases the chance of credential exposure through shell history, logs, screenshots, or shared terminal sessions.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The header comment and CLI checks state that OPENROUTER_API_KEY is required, implying authenticated API use. However, fetchAllModels performs an unauthenticated fetch to the public models endpoint and never includes the API key, so the documentation overstates the code's dependency on credentials.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/free-models.js:13