Free Ride 1.0.4

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:03 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for configuring OpenClaw with OpenRouter free models, but it needs Review because it can expose an API key and persistently rewrite OpenClaw model settings without strong confirmation or rollback controls.

Install only if you are comfortable letting this skill read and use an OpenRouter API key, modify your OpenClaw model configuration, and optionally run a watcher that can keep changing the active model. Do not print the API key with `echo`; use a presence-only check instead, keep a backup of `~/.openclaw/openclaw.json`, and prefer pinned install/dependency versions before using it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16
• Finding: API Key Exposed by Prerequisite Verification Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Sensitive credential disclosure **Risk Level**: Medium ### Vulnerable Code ```markdown Before running any FreeRide command, ensure: 1. **OPENROUTER_API_KEY is set.** Check with `echo $OPENROUTER_API_KEY`. If empty, the user must get a free key at https://openrouter.ai/keys and set it: ```bash export OPENROUTER_API_KEY="sk-or-v1-..." # Or persist it: openclaw config set env.OPENROUTER_API_KEY "sk-or-v1-..." ``` ``` ### Technical Analysis The instruction directs the agent or user to print the complete `OPENROUTER_API_KEY` value. Although checking that the environment variable exists is necessary, revealing its content is not. Terminal output may be retained in agent transcripts, CI logs, shell recordings, observability systems, screenshots, or support diagnostics. The implementation otherwise handles the key as an authentication credential, sending it as a Bearer token only to OpenRouter. Printing it therefore introduces an unnecessary disclosure channel and exceeds the minimum access needed to verify configuration. ### Attack Path 1. A user invokes the Skill or asks the agent to configure FreeRide. 2. The agent follows the prerequisite instructions in `SKILL.md`. 3. The agent executes `echo $OPENROUTER_API_KEY`. 4. The complete API key appears in terminal output or the agent transcript. 5. Another user, process, logging operator, or compromised integration with access to that output obtains the key. 6. The exposed key is used to authenticate requests against the victim's OpenRouter account. ### Impact Assessment An attacker who obtains the key may make authenticated OpenRouter API requests under the victim's account. The practical scope depends on the permissions, limits, credits, and account configuration associated with that key. Potential consequences include quota consumption, unexpected ...[truncated 275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the value-printing check with a presence-only test: ```bash if test -n "${OPENROUTER_API_KEY:-}"; then echo "OPENROUTER_API_KEY is set" else echo "OPENROUTER_API_KEY is not set" fi ``` - Explicitly instruct agents never to print, log, or include the key in conversation output. - Avoid displaying even partially masked credentials unless operationally necessary. - Recommend revoking and regenerating any key that has already appeared in logs or transcripts. - Where supported, store the credential in a dedicated secret store rather than plaintext configuration. ]]>

T08 · Insecure Dependencies

Warning

• Location: skill.json:41
• Finding: Mutable and Incompletely Pinned Installation Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: - `skill.json`, line 41 - `README.md`, lines 47–49 - `setup.py`, lines 10–12 - `requirements.txt`, line 1 **Vulnerability Type**: Non-reproducible dependency and installer resolution **Risk Level**: Medium ### Vulnerable Code `skill.json`: ```json "install": "npx clawhub@latest install freeride && cd ~/.openclaw/workspace/skills/free-ride && pip install -e ." ``` `README.md`: ```bash npx clawhub@latest install freeride cd ~/.openclaw/workspace/skills/free-ride pip install -e . ``` `setup.py`: ```python install_requires=[ "requests>=2.31.0", ], ``` `requirements.txt`: ```text requests>=2.31.0 ``` ### Technical Analysis The installation workflow executes `npx clawhub@latest`, which resolves to whichever package version is currently published under that package name. The effective installer can therefore change after this Skill version has been reviewed. The Python dependency specifies only a minimum version. A future installation may resolve to any later `requests` release and its transitive dependency set. No lockfile, exact version constraints, package hashes, or other integrity verification is provided. No malicious dependency was identified in the audited files. The vulnerability is the mutable supply-chain boundary: future upstream compromise, malicious package replacement, or an unsafe release could cause installations of the same Skill version to execute or import code that was not part of the audit. ### Attack Path 1. An attacker compromises an upstream publisher account, release pipeline, package registry entry, or dependency distribution channel. 2. The attacker publishes a malicious version that satisfies `@latest` or the `>=2.31.0` constraint. 3. A user or agent follows the documented installation command. 4. The package manager resolves the mutable specification to the attacker-controlled release. 5. In ...[truncated 892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `npx clawhub@latest` with an explicitly reviewed version, for example `npx clawhub@<reviewed-version>`. - Pin Python dependencies to reviewed exact versions rather than open-ended lower bounds. - Generate and publish a lockfile containing hashes, using a workflow such as `pip-compile --generate-hashes`. - Install with hash enforcement where practical: ```bash pip install --require-hashes -r requirements.txt ``` - Review and pin relevant transitive dependencies, not only the direct `requests` dependency. - Use trusted registries and enable package provenance, signature, or integrity verification where supported. - Automate dependency updates through reviewed pull requests and security scanning rather than resolving unrestricted future versions during installation. - Keep installation commands consistent across `README.md`, `skill.json`, `setup.py`, and `requirements.txt`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

}

    try:
        response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        return data.get("data", [])

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README presents `freeride auto` as a one-command setup that modifies `openclaw.json` and later instructs the user to restart the gateway, but it does not clearly warn that local configuration and running service state will be changed. This can lead users to make unexpected persistent changes, disrupt active workflows, or overwrite intended model settings without informed consent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx clawhub@latest install freeride`, which fetches and executes the latest package version at install time without pinning to a specific trusted release. This creates a supply-chain risk: if the package or one of its dependencies is compromised, users may execute attacker-controlled code during installation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README tells users to place an OpenRouter API key in an environment variable or OpenClaw config, but it does not include guidance on secure credential handling. Users may store secrets in plaintext config files, shell history, screenshots, or shared environments, increasing the chance of credential leakage and unauthorized API use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to read environment variables, access and modify configuration files, install packages, and use network-backed services, yet it declares no explicit tool scope or permissions. This creates unnecessary ambient authority: an agent may invoke sensitive capabilities without clear restriction or user awareness, increasing the blast radius if the skill is triggered unexpectedly or behaves incorrectly.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description contains broad activation cues like 'free AI,' 'model switching,' 'rate limits,' and 'reduce AI costs,' which can match many ordinary conversations and cause the skill to trigger outside narrowly intended contexts. Because the skill performs config changes and restart actions, overly loose activation materially raises the chance of unintended execution and unauthorized environment modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells the user to export and persist an API key, including storing it via a config command, but it provides no warning about credential sensitivity, storage risks, shell history exposure, or safer secret-handling practices. In a skill that also modifies config and may operate in shared or synced environments, this increases the likelihood of accidental credential disclosure or insecure long-term storage.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill can modify the user's authentication profile configuration by adding an OpenRouter auth profile, but this behavior is not clearly disclosed in the manifest description. Hidden auth-related configuration changes can surprise users and expand the skill's effective scope beyond simple model ranking/switching.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill overwrites the user's active OpenClaw configuration without any confirmation, backup, or preview of the changes. This can unexpectedly redirect future model usage, break existing setups, or silently alter operational behavior in a way the user did not intend.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: This is a manifest file, so vague-trigger checks apply. The description broadly advertises "Unlimited free AI access for OpenClaw" and automatic fallback behavior, but it does not define when this skill should be invoked, what user intents map to it, or any exclusion conditions, making activation scope ambiguous in systems that rely on manifest text for routing.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The manifest requires an `OPENROUTER_API_KEY` and indicates use of an external AI provider, but it gives no warning about where the credential will be transmitted, stored, or how it will be protected. In a skill that manages remote model access and rewrites local configuration, lack of credential-handling disclosure materially increases the risk of accidental secret exposure or unsafe user trust assumptions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The install command executes `npx clawhub@latest`, which pulls and runs whatever code is current at install time rather than a reviewed, immutable version. This creates a supply-chain risk: a compromised or malicious upstream package version could execute arbitrary code during installation and gain access to the user's environment, including credentials and local files.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

    try:
        response = requests.post(
            OPENROUTER_CHAT_URL,
            headers=headers,
            json=payload,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The watcher automatically rewrites the user's OpenClaw configuration when it detects rate limits or availability changes, without an interactive confirmation or a separate opt-in at the moment of modification. In an agent skill context, silent persistent config changes can violate user expectations, alter future model-routing behavior, and create a confused-deputy risk if triggered indirectly by normal operation or automation.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The manifest describes model ranking, fallback configuration, and updating openclaw.json. In addition to that, the code retrieves the OpenRouter API key from both environment variables and the OpenClaw config, and later exposes its presence/status, which is broader than simple model management behavior.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill persists a cache of model metadata under the user's home directory without explicit warning or consent. While the cached data does not appear to include secrets, undisclosed local persistence can still create privacy and transparency issues and may retain information longer than users expect.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

• Confidence: 97% confidence
• Finding: The dependency is specified as `requests>=2.31.0`, which allows any future version and does not guarantee a reproducible or reviewed install. This can introduce vulnerable, incompatible, or unexpected releases into the environment over time, especially since the skill appears to manage networked AI services and likely relies on HTTP requests.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: Because `requests` is unpinned, it is not possible to determine from the manifest whether deployment will use a version affected by one of several known advisories. In a skill that interacts with external services like OpenRouter, this uncertainty matters more because HTTP client flaws can expose credentials, weaken transport guarantees, or mishandle redirects and authentication.

Static analysis

No suspicious patterns detected.