T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
jobs/outbound-builder.py:10- Finding
Undisclosed Transmission of Local Outreach Data to OpenRouter
- Content
View full analysis
- Remediation
View remediation
Security audit
Free Model Router
Security checks for vulnerabilities and agentic risk
Overview
The advertised model-management tool includes undisclosed marketing and monitoring scripts that can use the user's API key, local tools, and home-directory files for unrelated work.
Review before installing. The advertised FreeRide commands may be useful, but the package also contains unrelated scripts for lead collection, DM drafting, and checkout monitoring. Do not run anything in the jobs directory unless you intentionally want that behavior and are comfortable sending the collected data to OpenRouter and writing results under ~/rick-vault. Prefer checking whether OPENROUTER_API_KEY is set without printing the full value, and back up ~/.openclaw/openclaw.json before changing model settings.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
jobs/buyer-intent-radar.py:14- Finding
Undisclosed Owner-Specific Lead Collection and Conversion Monitoring Jobs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:14- Finding
OpenRouter API Key Exposed by Skill Prerequisite Instruction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (37)
Tainted flow: 'OPENROUTER_API_KEY' from os.environ.get (line 11, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python messages.append({"role": "user", "content": prompt}) try: resp = requests.post( "https://openrouter.ai/api/v1/chat/completions", headers={ "Authorization": f"Bearer {OPENROUTER_API_KEY}",
Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } try: response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30) response.raise_for_status() data = response.json() return data.get("data", [])
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about OpenRouter/OpenClaw model management: ranking free AI models, setting fallback behavior for rate limits, and modifying OpenClaw configuration. The supplied code does none of that. Instead, it is a social-media lead generation workflow focused on X/Twitter, using subprocess calls to an external xpost tool, querying for predefined phrases, checking mentions, scoring tweets for purchase intent, generating outreach drafts, saving leads, and notifying on hot leads. This is a materially different primary purpose with substantially different capabilities and resources than declared.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill manages free AI models from OpenRouter for OpenClaw, including ranking models, handling fallback configuration for rate limits, and updating configuration files. The supplied code does none of that. Instead, it acts as a website/checkout monitoring job for meetrick.ai and related payment/subscription endpoints, uses an AI model only to analyze page content for conversion issues, then stores results and alerts on critical findings. This is a materially different primary purpose and involves undeclared external resource access unrelated to OpenRouter/OpenClaw model management.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a configuration/management skill for OpenRouter free models in OpenClaw, specifically ranking models, setting fallbacks, and updating openclaw.json. The supplied code does none of those core tasks. Instead, it defines helper functions to call one specified OpenRouter model, save arbitrary JSON outputs to a separate filesystem location, notify via the openclaw command, and parse JSON from text. The OpenRouter API usage is related at a high level, but the primary behavior is materially different from the claimed purpose, and it includes undeclared local file output and CLI notification behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about OpenRouter/OpenClaw model management and configuration, including ranking free models, setting fallbacks for rate limits, and updating openclaw.json. The supplied code does none of that. Instead, it is an outbound message generation job for sales leads: it loads target and radar lead data, builds prompts for personalized DMs, invokes a model to generate JSON-formatted drafts, saves those drafts to outreach directories, records job output, and notifies the user. This is a materially different primary purpose and accesses unrelated resources (outreach targets, radar leads, drafts directories rather than OpenClaw/OpenRouter config).
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file's behavior is materially unrelated to the declared skill purpose of managing free OpenRouter models and updating
openclaw.json. Instead, it performs social-media lead scraping, scoring, and outreach drafting on X, which indicates hidden functionality and a likely attempt to smuggle unauthorized data collection and marketing automation into an unrelated skill package.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code invokes an external social-media CLI to search X and collect mentions, which is unjustified for a skill advertised as OpenRouter model management. This hidden external-capability use expands the skill's access surface, can harvest third-party content without user awareness, and is especially dangerous because it is embedded under misleading metadata that would reduce operator scrutiny.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This job is materially unrelated to the declared skill purpose of managing free OpenRouter models and OpenClaw configuration. It performs external site crawling, analyzes payment and subscription pages, generates reports, and sends notifications, which indicates hidden secondary behavior and expands the skill's operational scope in a way users would not reasonably expect.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The hardcoded monitoring of meetrick.ai pages, Stripe checkout links, and a Railway subscription endpoint is not justified by a model-management skill and suggests covert business intelligence or payment funnel surveillance. Because these targets are external and specific, the behavior is more suspicious than generic health checking and creates risk of unauthorized reconnaissance and trust violations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file implements outbound lead processing and personalized DM generation, which is unrelated to the declared skill purpose of managing free OpenRouter models and updating configuration. The hidden scope expansion is dangerous because it gives the skill undisclosed access to prospect data and enables sales/outreach automation under a misleading manifest, undermining user trust and consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code consumes radar lead-scoring output, filters prospects, and generates outreach drafts, creating a customer targeting pipeline not justified by the stated model-management functionality. In the context of this skill, that mismatch makes the behavior more dangerous because users invoking a cost-saving/model-switching tool would not reasonably expect prospect profiling and outbound messaging operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Stop paying for AI. Start riding free. [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Stop paying for AI. Start riding free. [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Stop paying for AI. Start riding free. [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Stop paying for AI. Start riding free. [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride) [](https://clawhub.ai/skills/free-ride)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file says the skill automatically manages models, and later shows it sets models, configures fallbacks, and requires
openclaw gateway restart. While the behavior is documented functionally, there is no explicit warning section alerting users that the skill will modify~/.openclaw/openclaw.jsonand may affect running agent behavior after restart. For a skill that changes configuration and triggers service restarts, a user-facing warning would improve safety disclosure.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The README instructs users to run
npx clawhub@latest install free-ride, which fetches and executes the latest remote package version at install time. Because the version is not pinned, users are exposed to supply-chain risk if the package is compromised or a malicious update is published.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README advises storing an OpenRouter API key in OpenClaw configuration without warning about persistence, file permissions, secret exposure, or preferring environment variables. Persisting credentials in application config can leak secrets through backups, logs, shared machines, or accidental commits if users copy configs into repositories.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs use of environment variables, shell commands, network-dependent setup, and modification of local configuration, but it declares no explicit tool scope or permissions. This creates an avoidable trust gap: an agent may invoke sensitive capabilities implicitly without users or the platform having a clear allowlist boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation guidance is broad enough that routine mentions of 'free AI,' 'model switching,' or 'rate limits' could trigger the skill in contexts where the user did not intend local configuration changes. Because the skill can modify config and prompt a gateway restart, overbroad activation increases the risk of unintended system changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow directs changes to ~/.openclaw/openclaw.json and a gateway restart as a default action, but it does not require an explicit warning or confirmation about modifying the user's local setup. This is dangerous because an automatically triggered skill could alter service behavior, replace model settings, and cause disruption or confusion without informed consent.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_xpost(args): """Run xpost command and parse JSON output.""" try: result = subprocess.run( ["xpost"] + args, capture_output=True, text=True, timeout=30, )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Tweets, usernames, and follower metadata are packaged into prompts and sent to an external model without any disclosure, consent flow, or data-handling notice. Even if the data is partly public, transmitting collected social-media content to a third-party model provider creates privacy, compliance, and reputational risk, especially in a skill whose stated purpose gives users no reason to expect such sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Fetched page content from third-party URLs is forwarded to a model for analysis without any disclosure, minimization, or consent mechanism in this file. That can leak sensitive or proprietary page contents, including checkout-page details or transient tokens, to another processing system and increases supply-chain/privacy risk.
- Content
Static analysis
No suspicious patterns detected.