Free Ride - Unlimited free AI

Manages free AI models from OpenRouter for OpenClaw. Automatically ranks models by quality, configures fallbacks for rate-limit handling, and updates opencla...

Security Scan

The skill's code mostly matches its stated purpose (managing OpenRouter free models) but it silently modifies OpenClaw config beyond the exact keys the README/SKILL.md promise and includes an optional daemon that will run regularly and use your API key(s).

Purpose & Capability

The name, description, requested network access (openrouter.ai) and the single secret (OPENROUTER_API_KEY) align with a tool that lists, ranks, and configures OpenRouter free models. However, the SKILL.md claims FreeRide 'preserves everything else' and only writes agents.defaults.model and agents.defaults.models, while the code's setup_openrouter_auth() will add an auth profile under config['auth']['profiles'] if missing. That is a functional change to the OpenClaw config not stated in the docs.

Instruction Scope

Runtime instructions (set OPENROUTER_API_KEY, pip install -e ., run 'freeride auto', restart gateway) are appropriate. The code reads the full OpenClaw config (~/.openclaw/openclaw.json) and may write cache and watcher state files (declared in SKILL.md). The mismatch is that the SKILL.md explicitly promises to only touch certain keys but the implementation also ensures an OpenRouter auth profile is present (modifies config['auth']). This is scope-creep relative to the documentation and should be disclosed to users.

Install Mechanism

Install is via local pip (pip install -e .) from the package included in the skill; setup.py only depends on requests. No remote, arbitrary downloads or obscure URLs are used. The skill.json contains an install helper (npx clawhub...) but nothing in the files indicates high-risk install behavior.

Credentials

Only OPENROUTER_API_KEY is required (env or stored in OpenClaw config). That matches the skill's purpose. The code supports multiple keys (JSON array) for rotation, which is reasonable for a tool intended to handle rate limits. No other secrets or unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true and is user-invocable. It will create and update files under ~/.openclaw (openclaw.json, .freeride-cache.json, .freeride-watcher-state.json). The watcher can run as a daemon and will periodically make network requests using your API key(s) to probe models and rotate them. This long-running behavior is expected for auto-rotation but increases the blast radius if the keys are compromised or misused—users should be aware before enabling the daemon.

Scan Findings in Context

[no_findings] expected: No pre-scan injection signals were detected. The code performs network requests to openrouter.ai and filesystem reads/writes under ~/.openclaw, which are expected for this skill.

What to consider before installing

This skill appears to do what it says (manage OpenRouter free models) and only needs your OpenRouter API key(s). Before installing: 1) Back up ~/.openclaw/openclaw.json (the skill will read and modify it). 2) Note the implementation will add an OpenRouter auth profile to your OpenClaw config (not highlighted in SKILL.md) and will create cache and watcher state files under ~/.openclaw. 3) If you enable the freeride-watcher daemon it will periodically use your key(s) to probe/rotate models — only enable if you trust the code and your keys. If you're unsure, inspect the included Python files locally (main.py and watcher.py) or run commands manually without the daemon. Overall: coherent functionality but the docs understate some config changes and the daemon behavior, so proceed with caution.

FreeRide - Free AI for OpenClaw

What This Skill Does

Configures OpenClaw to use free AI models from OpenRouter. Sets the best free model as primary, adds ranked fallbacks so rate limits don't interrupt the user, and preserves existing config.

Prerequisites

Before running any FreeRide command, ensure:

1. OPENROUTER_API_KEY is set. Check with echo $OPENROUTER_API_KEY. If empty, the user must get a free key at https://openrouter.ai/keys and set it:

   export OPENROUTER_API_KEY="sk-or-v1-..."
   # Or persist it:
   openclaw config set env.OPENROUTER_API_KEY "sk-or-v1-..."
   

2. The freeride CLI is installed. Check with which freeride. If not found:

   cd ~/.openclaw/workspace/skills/free-ride
   pip install -e .
   

Primary Workflow

When the user wants free AI, run these steps in order:

# Step 1: Configure best free model + fallbacks
freeride auto

# Step 2: Restart gateway so OpenClaw picks up the changes
openclaw gateway restart

That's it. The user now has free AI with automatic fallback switching.

Verify by telling the user to send /status to check the active model.

Commands Reference

Command	When to use it
freeride auto	User wants free AI set up (most common)
freeride auto -f	User wants fallbacks but wants to keep their current primary model
freeride auto -c 10	User wants more fallbacks (default is 5)
freeride list	User wants to see available free models
freeride list -n 30	User wants to see all free models
freeride switch <model>	User wants a specific model (e.g. freeride switch qwen3-coder)
freeride switch <model> -f	Add specific model as fallback only
freeride status	Check current FreeRide configuration
freeride fallbacks	Update only the fallback models
freeride refresh	Force refresh the cached model list

After any command that changes config, always run openclaw gateway restart.

What It Writes to Config

FreeRide updates only these keys in ~/.openclaw/openclaw.json:

• agents.defaults.model.primary — e.g. openrouter/qwen/qwen3-coder:free
• agents.defaults.model.fallbacks — e.g. ["openrouter/free", "nvidia/nemotron:free", ...]
• agents.defaults.models — allowlist so /model command shows the free models

Everything else (gateway, channels, plugins, env, customInstructions, named agents) is preserved.

The first fallback is always openrouter/free — OpenRouter's smart router that auto-picks the best available model based on the request.

Watcher (Optional)

For auto-rotation when rate limited, the user can run:

freeride-watcher --daemon    # Continuous monitoring
freeride-watcher --rotate    # Force rotate now
freeride-watcher --status    # Check rotation history

Troubleshooting

Problem	Fix
freeride: command not found	cd ~/.openclaw/workspace/skills/free-ride && pip install -e .
OPENROUTER_API_KEY not set	User needs a key from https://openrouter.ai/keys
Changes not taking effect	openclaw gateway restart then /new for fresh session
Agent shows 0 tokens	Check freeride status — primary should be openrouter/<provider>/<model>:free