Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Ride - Unlimited free AI

Manages free AI models from OpenRouter for OpenClaw. Automatically ranks models by quality, configures fallbacks for rate-limit handling, and updates opencla...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
356 · 48.9k · 368 current installs · 395 all-time installs
byShaishav Pidadi@shaivpidadi
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md, main.py, and watcher.py all implement the stated purpose: calling OpenRouter, ranking free models, and updating ~/.openclaw/openclaw.json. However, the top-level registry metadata shown earlier said "required env vars: none" and "primary credential: none", while SKILL.md and skill.json require an OPENROUTER_API_KEY. This mismatch is a packaging/information inconsistency.
Instruction Scope
Runtime instructions are narrowly scoped to fetching models from OpenRouter, updating only agents.defaults.model and agents.defaults.models in ~/.openclaw/openclaw.json, caching state in ~/.openclaw, and optionally running a watcher daemon. The skill reads the OpenClaw config and environment for an OPENROUTER_API_KEY (declared in skill.json and SKILL.md). There are no instructions to read unrelated system files or send data to unexpected endpoints.
Install Mechanism
Installation is via pip install -e . in the skill workspace (setup.py) and declares only the requests dependency. That's a low-to-moderate risk pattern (local pip install, dependency from PyPI). There is an install command in skill.json referencing npx clawhub + pip install, but the registry summary earlier said "No install spec"—another metadata mismatch to watch for. No remote arbitrary archive downloads are present.
Credentials
The only secret the skill needs is an OpenRouter API key (OPENROUTER_API_KEY), which is appropriate for a tool that calls the OpenRouter API. The code also looks for the key inside ~/.openclaw/openclaw.json env section as a fallback. All environment/config access is scoped to OpenClaw config and the user's home ~/.openclaw directory.
Persistence & Privilege
The skill does persist files (cache and watcher state) under ~/.openclaw and overwrites keys in ~/.openclaw/openclaw.json (limited to agents.defaults.model and agents.defaults.models and potentially adding an auth profile). It does not request always:true, does not modify unrelated system settings, and does not require elevated privileges.
What to consider before installing
This skill appears to do what it claims (manage OpenRouter free models and edit your OpenClaw config). Still, there are small packaging inconsistencies: the registry summary omitted the required OPENROUTER_API_KEY and install instructions, while SKILL.md and skill.json do require the key and pip installation. Before installing: 1) Back up ~/.openclaw/openclaw.json. 2) Inspect the included files yourself (main.py, watcher.py, setup.py) — they will run on your machine and make network calls to openrouter.ai. 3) Only set OPENROUTER_API_KEY if you trust the source; the watcher daemon will periodically call OpenRouter and store state in ~/.openclaw. 4) Prefer to install from a trusted upstream (official repo or verified package) rather than an unknown workspace copy. The inconsistencies look like sloppy packaging rather than clear malicious behavior, but exercise caution.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.7
Download zip
latestvk979d1h1kjqbt29eff5w87yv9h83pfqr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

FreeRide - Free AI for OpenClaw

What This Skill Does

Configures OpenClaw to use free AI models from OpenRouter. Sets the best free model as primary, adds ranked fallbacks so rate limits don't interrupt the user, and preserves existing config.

Prerequisites

Before running any FreeRide command, ensure:

  1. OPENROUTER_API_KEY is set. Check with echo $OPENROUTER_API_KEY. If empty, the user must get a free key at https://openrouter.ai/keys and set it:

    export OPENROUTER_API_KEY="sk-or-v1-..."
    # Or persist it:
    openclaw config set env.OPENROUTER_API_KEY "sk-or-v1-..."
    
  2. The freeride CLI is installed. Check with which freeride. If not found:

    cd ~/.openclaw/workspace/skills/free-ride
    pip install -e .
    

Primary Workflow

When the user wants free AI, run these steps in order:

# Step 1: Configure best free model + fallbacks
freeride auto

# Step 2: Restart gateway so OpenClaw picks up the changes
openclaw gateway restart

That's it. The user now has free AI with automatic fallback switching.

Verify by telling the user to send /status to check the active model.

Commands Reference

CommandWhen to use it
freeride autoUser wants free AI set up (most common)
freeride auto -fUser wants fallbacks but wants to keep their current primary model
freeride auto -c 10User wants more fallbacks (default is 5)
freeride listUser wants to see available free models
freeride list -n 30User wants to see all free models
freeride switch <model>User wants a specific model (e.g. freeride switch qwen3-coder)
freeride switch <model> -fAdd specific model as fallback only
freeride statusCheck current FreeRide configuration
freeride fallbacksUpdate only the fallback models
freeride refreshForce refresh the cached model list

After any command that changes config, always run openclaw gateway restart.

What It Writes to Config

FreeRide updates only these keys in ~/.openclaw/openclaw.json:

  • agents.defaults.model.primary — e.g. openrouter/qwen/qwen3-coder:free
  • agents.defaults.model.fallbacks — e.g. ["openrouter/free", "nvidia/nemotron:free", ...]
  • agents.defaults.models — allowlist so /model command shows the free models

Everything else (gateway, channels, plugins, env, customInstructions, named agents) is preserved.

The first fallback is always openrouter/free — OpenRouter's smart router that auto-picks the best available model based on the request.

Watcher (Optional)

For auto-rotation when rate limited, the user can run:

freeride-watcher --daemon    # Continuous monitoring
freeride-watcher --rotate    # Force rotate now
freeride-watcher --status    # Check rotation history

Troubleshooting

ProblemFix
freeride: command not foundcd ~/.openclaw/workspace/skills/free-ride && pip install -e .
OPENROUTER_API_KEY not setUser needs a key from https://openrouter.ai/keys
Changes not taking effectopenclaw gateway restart then /new for fresh session
Agent shows 0 tokensCheck freeride status — primary should be openrouter/<provider>/<model>:free

Files

7 total
Select a file
Select a file to preview.

Comments

Loading comments…