Tsz

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 1.0.0

Overview

This package should go to Review because it is published as a self-improvement skill but also contains unrelated tools that use API keys, contact external AI services, and change OpenClaw configuration.

Do not install this package as a self-improvement skill until the publisher splits or repackages it under one clear identity, removes unrelated FreeRide/Gemini/proposal content, and adds explicit consent, redaction, reviewable diffs, backups, and rollback for persistent memory and configuration changes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:16

Finding

Untrusted conversation content can be promoted into persistent agent instructions

Content

View full analysis

Remediation

View remediation

other

Error

• Location: _meta.json:2

Finding

Package metadata and executable contents identify different products

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate_image.py:75

Finding

Unrelated image utility can upload local images and prompts to Gemini

Content

View full analysis

str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY") ``` `scripts/generate_image.py:75-108`: ```python client = genai.Client(api_key=api_key) output_path = Path(args.filename) output_path.parent.mkdir(parents=True, exist_ok=True) input_image = None output_resolution = args.resolution if args.input_image: try: input_image = PILImage.open(args.input_image) print(f"Loaded input image: {args.input_image}") if args.resolution == "1K": width, height = input_image.size max_dim = max(width, height) if max_dim >= 3000: output_resolution = "4K" elif max_dim >= 1500: output_resolution = "2K" else: output_resolution = "1K" print(f"Auto-detected resolution: {output_resolution} (from input {width}x{height})") except Exception as e: print(f"Error loading input image: {e}", file=sys.stderr) sys.exit(1) if input_image: contents = [input_image, args.prompt] print(f"Editing image with resolution {output_resolution}...") else: contents = args.prompt print(f"Generating image with resolution {output_resolution}...") ``` The resulting content is transmitted by: ```python response = client.models.generate_content( model="gemini-3-pro-image-preview", contents=contents, config=types.GenerateContentConfig( response_modalities=["TEXT", "IMAGE"], image_config=types.ImageConfig( im ...[truncated 1859 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:203

Finding

OpenClaw configuration is overwritten without atomicity, locking, backup, or rollback

Content

View full analysis

= 5: break config["agents"]["defaults"]["model"]["fallbacks"] = fallbacks save_openclaw_config(config) state["rotation_count"] = state.get("rotation_count", 0) + 1 state["last_rotation"] = datetime.now().isoformat() state["last_rotation_reason"] = reason save_state(state) ``` `watcher.py:268-289`: ```python state = load_state() while running: try: cleanup_old_rate_limits(state) check_and_rotate(api_key, state) except Exception as e: print(f"Error during check: {e}") for _ in range(CHECK_INTERVAL_SECONDS): if not running: break time.sleep(1) ``` ### Technical Analysis `save_openclaw_config` writes directly to the central `~/.openclaw/openclaw.json` file. It does not use a temporary file and atomic rename, acquire a file lock, preserve a backup, validate the complete resulting schema, enforce restrictive permissions, or provide rollback. The daemon can perform checks every 60 seconds and call this function whenever it decides rotation is needed. Concurrent writes by OpenClaw, FreeRide commands, or multiple watcher instances ...[truncated 1440 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Dependencies use mutable version ranges without integrity verification

Content

View full analysis

=2.31.0 ``` `scripts/generate_image.py:2-7`: ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` `README.md:35-39`: ```bash git clone https://github.com/Shaivpidadi/FreeRide.git cd FreeRide pip install -r requirements.txt ``` ### Technical Analysis The package specifies open-ended minimum versions rather than reviewed exact versions. It does not provide a lockfile or cryptographic hashes. Consequently, installation at different times may resolve to different package and transitive-dependency versions. The inline `uv` metadata for the image utility similarly permits future `google-genai` and Pillow releases. Running the script through `uv run` can resolve packages that did not exist when this artifact was reviewed. No evidence was found that the currently named dependencies are malicious, typosquatted, or fetched from a nonstandard registry. The confirmed issue is the absence of reproducible and integrity-verified dependency resolution. ### Attack Path 1. A user follows the documented installation command or runs the inline-dependency image script. 2. The package manager resolves the newest versions satisfying the `>=` constraints. 3. A future compromised, malicious, or incompatible release satisfies the constraints. 4. Package installation or import executes code from that unreviewed release under the user’s account. 5. The dependency receives the process’s filesystem, environment, and network access, including potentially available API-key environment variables. ### Impact Assessment A compromised dependency would execute with the same privileges as the installing or invoking user. Poten ...[truncated 230 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (47)

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 74)May include surrounding context.

python

}

    try:
        response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        return data.get("data", [])

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content describes a FreeRide tool for model switching, API-key usage, and configuration changes, which is fundamentally inconsistent with the declared skill purpose of self-improvement via capturing learnings and corrections. In a skill ecosystem, this type of capability/identity mismatch is dangerous because it can conceal unrelated or unauthorized behavior behind trusted metadata, undermining user consent and review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented ability to auto-configure model settings and fallbacks changes OpenClaw behavior in ways unrelated to a self-improvement skill’s stated purpose. Because the skill context does not justify configuration management, these instructions suggest hidden scope expansion or deceptive packaging, increasing the risk of unauthorized modifications to user environment and routing of future AI traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill is framed as a passive learning/error log, but it also instructs use of helper scripts that create directories/files and scaffold new skills from learning entries. That is a real expansion from note-taking into code/content generation and filesystem modification, which can surprise operators and increase write-side risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill is framed as a passive learning/error log, but it also instructs use of helper scripts that create directories/files and scaffold new skills from learning entries. That is a real expansion from note-taking into code/content generation and filesystem modification, which can surprise operators and increase write-side risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill is framed as a passive learning/error log, but it also instructs use of helper scripts that create directories/files and scaffold new skills from learning entries. That is a real expansion from note-taking into code/content generation and filesystem modification, which can surprise operators and increase write-side risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill is framed as a passive learning/error log, but it also instructs use of helper scripts that create directories/files and scaffold new skills from learning entries. That is a real expansion from note-taking into code/content generation and filesystem modification, which can surprise operators and increase write-side risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill reads OPENROUTER_API_KEY from environment/config and makes external requests to OpenRouter, which is unrelated to a self-improvement function. In the context of a mislabeled skill, credential access plus outbound networking materially increases risk because the skill gains the ability to use sensitive runtime secrets and communicate externally under a misleading trust boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code implements a full 'FreeRide' model-management CLI for OpenRouter/OpenClaw rather than a self-improvement skill that captures learnings and corrections. This mismatch is dangerous because a user or orchestrator invoking the skill under the trusted 'self-improvement' label could unknowingly run code that changes model selection behavior and system configuration outside the declared purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code rewrites ~/.openclaw/openclaw.json, alters primary/fallback models, and can add an OpenRouter auth profile, none of which aligns with self-improvement. In this context, unauthorized configuration mutation can redirect future agent behavior, persist changes across sessions, and effectively act as a stealthy capability hijack.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Directing users to modify ~/.claude/settings.json establishes persistent behavior in the agent's configuration directory, affecting future sessions and potentially all projects. In the context of an auto-triggered command hook, this is more dangerous because it creates durable execution of local scripts with little ongoing visibility, increasing the impact of later script tampering or unintended behavior.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This script implements external image generation/editing with Gemini rather than anything related to capturing learnings, errors, or corrections for a self-improvement skill. That mismatch is dangerous because it expands the skill’s capabilities beyond its declared purpose, increasing the chance of hidden or unauthorized actions and making security review and user trust assumptions invalid.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GEMINI_API_KEY")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code calls an external generative AI service to create or edit images, which is unrelated to the declared self-improvement purpose. In this context, unjustified external capability is risky because it can be used to exfiltrate prompts/data, incur costs, or perform actions the user and reviewer would not expect from the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file's documented purpose and implementation are unrelated to the declared self-improvement skill. Instead of capturing learnings or corrections, it implements a FreeRide/OpenRouter model-rotation watcher, indicating significant scope drift and granting operational capabilities not justified by the manifest. In a skill ecosystem, this mismatch is dangerous because users or reviewers may authorize the skill based on benign metadata while the code performs unrelated control-plane actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section performs active external health checks against OpenRouter and is designed to support automated daemon behavior, which is not justified for a self-improvement skill. Such background network activity expands the attack surface, can consume credentials, and can be used to probe or manipulate service usage without user awareness. The contextual mismatch makes this more suspicious and dangerous than the same code in a clearly labeled monitoring skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code changes OpenClaw agent model configuration, including primary and fallback models, giving the skill the ability to alter runtime behavior of other components. In the context of a self-improvement skill, that is an unjustified privilege escalation path: a skill expected to record learnings can instead reconfigure model selection and influence future agent outputs or costs. The context makes this substantially more dangerous because the declared purpose would not lead reviewers to expect control over agent configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that the tool automatically manages OpenRouter free models, implying network interaction with an external API that is unrelated to capturing learnings or corrections. In the context of a mislabeled self-improvement skill, unjustified external communications are suspicious because they can exfiltrate metadata, obtain control inputs, or route user activity through third-party services without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx clawhub@latest install free-ride, which pulls and runs the latest package version without pinning. This creates a supply-chain risk: a compromised or malicious upstream release could be executed automatically on user machines, and the mismatch between the declared self-improvement skill and the README’s actual behavior makes that risk more concerning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Requiring an OpenRouter API key is unrelated to the declared self-improvement purpose and expands trust boundaries by asking users to provision third-party credentials. In a mismatched skill, credential collection is especially risky because users may provide secrets under false assumptions about what the skill is supposed to do.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill describes filesystem, environment, and network-capable operations but does not declare any explicit tool scope or allowlist. In agent systems, missing scope boundaries increases the chance that a skill can be invoked with broader-than-necessary privileges, especially when it includes hooks and shell-command examples.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill directs creation of persistent files under a home-directory workspace, enabling retention of conversation-derived data across sessions. Persistent memory is not inherently malicious, but in this context it becomes risky because the same skill also encourages broad logging of corrections, errors, and user context without strong privacy controls.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes inter-session communication and sharing of learnings across sessions, which can persist and redistribute user-provided details beyond the original interaction. Without minimization, consent, or redaction guidance, this creates a meaningful privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The learning-entry template asks for full context and detailed metadata, which can easily capture sensitive prompts, proprietary file paths, incident details, or personal information in persistent storage. Because the default pattern is to append to markdown logs, exposure can persist unnoticed and be reused later by other agents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.