abe-freeride

Manages AI models from SkillBoss API Hub for OpenClaw. Automatically ranks models by quality, configures fallbacks for rate-limit handling, and updates openc...

Security Scan

The skill generally matches its stated goal (manage free models and update OpenClaw config) but has several inconsistencies in documentation, metadata, and packaging that merit caution before installing.

Purpose & Capability

The code (main.py) performs model discovery via a remote SkillBoss endpoint and updates ~/.openclaw/openclaw.json to set primary/fallback models — this is coherent with the stated purpose. However, documentation is inconsistent: SKILL.md and main.py expect SKILLBOSS_API_KEY and use a SkillBoss endpoint (api.heybossai.com), while README and other docs repeatedly reference OpenRouter and OPENROUTER_API_KEY. Registry metadata declares no required env vars but the runtime instructions clearly require an API key. These mismatches suggest sloppy packaging or copy-paste from another project rather than outright malicious intent.

Instruction Scope

SKILL.md instructs the agent/user to set SKILLBOSS_API_KEY and to pip install the package in the skills workspace, then run commands that will modify ~/.openclaw/openclaw.json and restart the OpenClaw gateway. Those actions are within the skill's purpose. Concerns: (1) README and SKILL.md disagree on which API key to set (OPENROUTER_API_KEY vs SKILLBOSS_API_KEY); (2) the packaging advertises a watcher CLI (freeride-watcher) but watcher.py is empty and setup.py registers an entry point for it — the watcher described in docs likely won't work as-is; (3) the SKILL.md and README instruct modifying system/user config (openclaw.json) and restarting gateway — the user should be warned and back up config first. The instructions otherwise do not appear to read or exfiltrate unrelated files or secrets beyond the required API key.

Install Mechanism

No centralized install spec in registry; skill is delivered as code the user must pip install locally (pip install -e .) which is expected for Python skills. The code depends only on requests (requirements.txt). The packaging has an entry point for freeride-watcher but watcher.py is empty, indicating a broken or incomplete installer entrypoint rather than a harmful installer. No remote downloads or obscure URLs are used by the install step.

Credentials

Registry metadata lists no required env vars, but SKILL.md and the code require SKILLBOSS_API_KEY. README also references OPENROUTER_API_KEY (not used by main.py). Requesting a single API key for the model hub is proportionate to the skill's purpose, but the inconsistent/missing declarations are a red flag (user may not realize the skill requires an API key). The skill reads/writes the OpenClaw config and places a cache file under ~/.openclaw — those accesses are reasonable for its functionality but should be clearly declared.

Persistence & Privilege

The skill does not request permanent 'always' installation and is user-invocable only by default. It writes a cache file (~/.openclaw/.freeride-cache.json) and modifies ~/.openclaw/openclaw.json (its own expected config target). It also creates an auth profile entry under the same config file. These are normal for a config-management skill. There is no evidence it modifies other skills' files or global system settings outside the OpenClaw config.

What to consider before installing

This skill appears to implement the advertised behavior (discover free models and update your OpenClaw config), but the package and docs contain mismatches that justify caution. Before installing: (1) Back up ~/.openclaw/openclaw.json. (2) Inspect main.py yourself (it contacts https://api.heybossai.com and requires SKILLBOSS_API_KEY). (3) Note README mentions OPENROUTER_API_KEY but the code uses SKILLBOSS_API_KEY — clarify which key you must provide. (4) The watcher CLI is advertised but watcher.py is empty and the entry point will likely fail; treat watcher functionality as untrusted/unfinished. (5) Install in an isolated environment (virtualenv or VM), run freeride list first to see what it returns, and verify changes before restarting OpenClaw gateway. If you are uncomfortable with a remote API having an API key stored in your config, do not install. If you can, ask the publisher/maintainer for clarification and a release with consistent docs and a non-empty watcher implementation.

FreeRide - Free AI for OpenClaw

What This Skill Does

Configures OpenClaw to use free AI models via SkillBoss API Hub. Sets the best free model as primary, adds ranked fallbacks so rate limits don't interrupt the user, and preserves existing config.

Prerequisites

Before running any FreeRide command, ensure:

1. SKILLBOSS_API_KEY is set. Check with echo $SKILLBOSS_API_KEY. If empty, set it:

   export SKILLBOSS_API_KEY="sk-..."
   # Or persist it:
   openclaw config set env.SKILLBOSS_API_KEY "sk-..."
   

2. The freeride CLI is installed. Check with which freeride. If not found:

   cd ~/.openclaw/workspace/skills/free-ride
   pip install -e .
   

Primary Workflow

When the user wants free AI, run these steps in order:

# Step 1: Configure best free model + fallbacks
freeride auto

# Step 2: Restart gateway so OpenClaw picks up the changes
openclaw gateway restart

That's it. The user now has free AI with automatic fallback switching.

Verify by telling the user to send /status to check the active model.

Commands Reference

Command	When to use it
freeride auto	User wants free AI set up (most common)
freeride auto -f	User wants fallbacks but wants to keep their current primary model
freeride auto -c 10	User wants more fallbacks (default is 5)
freeride list	User wants to see available free models
freeride list -n 30	User wants to see all free models
freeride switch <model>	User wants a specific model (e.g. freeride switch qwen3-coder)
freeride switch <model> -f	Add specific model as fallback only
freeride status	Check current FreeRide configuration
freeride fallbacks	Update only the fallback models
freeride refresh	Force refresh the cached model list

After any command that changes config, always run openclaw gateway restart.

What It Writes to Config

FreeRide updates only these keys in ~/.openclaw/openclaw.json:

• agents.defaults.model.primary — e.g. openrouter/qwen/qwen3-coder:free
• agents.defaults.model.fallbacks — e.g. ["openrouter/free", "nvidia/nemotron:free", ...]
• agents.defaults.models — allowlist so /model command shows the free models

Everything else (gateway, channels, plugins, env, customInstructions, named agents) is preserved.

The first fallback is always openrouter/free — SkillBoss API Hub's smart router that auto-picks the best available model based on the request.

Watcher (Optional)

For auto-rotation when rate limited, the user can run:

freeride-watcher --daemon    # Continuous monitoring
freeride-watcher --rotate    # Force rotate now
freeride-watcher --status    # Check rotation history

Troubleshooting

Problem	Fix
freeride: command not found	cd ~/.openclaw/workspace/skills/free-ride && pip install -e .
SKILLBOSS_API_KEY not set	Set via export SKILLBOSS_API_KEY="sk-..."
Changes not taking effect	openclaw gateway restart then /new for fresh session
Agent shows 0 tokens	Check freeride status — primary should be openrouter/<provider>/<model>:free