Free Ride 1.0.4

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:03 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for configuring OpenClaw with OpenRouter free models, but it needs Review because it can expose an API key and persistently rewrite OpenClaw model settings without strong confirmation or rollback controls.

Install only if you are comfortable letting this skill read and use an OpenRouter API key, modify your OpenClaw model configuration, and optionally run a watcher that can keep changing the active model. Do not print the API key with `echo`; use a presence-only check instead, keep a backup of `~/.openclaw/openclaw.json`, and prefer pinned install/dependency versions before using it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

API Key Exposed by Prerequisite Verification Command

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.json:41

Finding

Mutable and Incompletely Pinned Installation Dependencies

Content

View full analysis

=2.31.0", ], ``` `requirements.txt`: ```text requests>=2.31.0 ``` ### Technical Analysis The installation workflow executes `npx clawhub@latest`, which resolves to whichever package version is currently published under that package name. The effective installer can therefore change after this Skill version has been reviewed. The Python dependency specifies only a minimum version. A future installation may resolve to any later `requests` release and its transitive dependency set. No lockfile, exact version constraints, package hashes, or other integrity verification is provided. No malicious dependency was identified in the audited files. The vulnerability is the mutable supply-chain boundary: future upstream compromise, malicious package replacement, or an unsafe release could cause installations of the same Skill version to execute or import code that was not part of the audit. ### Attack Path 1. An attacker compromises an upstream publisher account, release pipeline, package registry entry, or dependency distribution channel. 2. The attacker publishes a malicious version that satisfies `@latest` or the `>=2.31.0` constraint. 3. A user or agent follows the documented installation command. 4. The package manager resolves the mutable specification to the attacker-controlled release. 5. In ...[truncated 892 chars]

Remediation

View remediation

`. - Pin Python dependencies to reviewed exact versions rather than open-ended lower bounds. - Generate and publish a lockfile containing hashes, using a workflow such as `pip-compile --generate-hashes`. - Install with hash enforcement where practical: ```bash pip install --require-hashes -r requirements.txt ``` - Review and pin relevant transitive dependencies, not only the direct `requests` dependency. - Use trusted registries and enable package provenance, signature, or integrity verification where supported. - Automate dependency updates through reviewed pull requests and security scanning rather than resolving unrestricted future versions during installation. - Keep installation commands consistent across `README.md`, `skill.json`, `setup.py`, and `requirements.txt`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 74)May include surrounding context.

python

}

    try:
        response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        return data.get("data", [])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README presents freeride auto as a one-command setup that modifies openclaw.json and later instructs the user to restart the gateway, but it does not clearly warn that local configuration and running service state will be changed. This can lead users to make unexpected persistent changes, disrupt active workflows, or overwrite intended model settings without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub@latest install freeride, which fetches and executes the latest package version at install time without pinning to a specific trusted release. This creates a supply-chain risk: if the package or one of its dependencies is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README tells users to place an OpenRouter API key in an environment variable or OpenClaw config, but it does not include guidance on secure credential handling. Users may store secrets in plaintext config files, shell history, screenshots, or shared environments, increasing the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read environment variables, access and modify configuration files, install packages, and use network-backed services, yet it declares no explicit tool scope or permissions. This creates unnecessary ambient authority: an agent may invoke sensitive capabilities without clear restriction or user awareness, increasing the blast radius if the skill is triggered unexpectedly or behaves incorrectly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description contains broad activation cues like 'free AI,' 'model switching,' 'rate limits,' and 'reduce AI costs,' which can match many ordinary conversations and cause the skill to trigger outside narrowly intended contexts. Because the skill performs config changes and restart actions, overly loose activation materially raises the chance of unintended execution and unauthorized environment modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells the user to export and persist an API key, including storing it via a config command, but it provides no warning about credential sensitivity, storage risks, shell history exposure, or safer secret-handling practices. In a skill that also modifies config and may operate in shared or synced environments, this increases the likelihood of accidental credential disclosure or insecure long-term storage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill can modify the user's authentication profile configuration by adding an OpenRouter auth profile, but this behavior is not clearly disclosed in the manifest description. Hidden auth-related configuration changes can surprise users and expand the skill's effective scope beyond simple model ranking/switching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill overwrites the user's active OpenClaw configuration without any confirmation, backup, or preview of the changes. This can unexpectedly redirect future model usage, break existing setups, or silently alter operational behavior in a way the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The description broadly advertises "Unlimited free AI access for OpenClaw" and automatic fallback behavior, but it does not define when this skill should be invoked, what user intents map to it, or any exclusion conditions, making activation scope ambiguous in systems that rely on manifest text for routing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest requires an OPENROUTER_API_KEY and indicates use of an external AI provider, but it gives no warning about where the credential will be transmitted, stored, or how it will be protected. In a skill that manages remote model access and rewrites local configuration, lack of credential-handling disclosure materially increases the risk of accidental secret exposure or unsafe user trust assumptions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The install command executes npx clawhub@latest, which pulls and runs whatever code is current at install time rather than a reviewed, immutable version. This creates a supply-chain risk: a compromised or malicious upstream package version could execute arbitrary code during installation and gain access to the user's environment, including credentials and local files.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · watcher.py (reported line 98)May include surrounding context.

python

}

    try:
        response = requests.post(
            OPENROUTER_CHAT_URL,
            headers=headers,
            json=payload,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The watcher automatically rewrites the user's OpenClaw configuration when it detects rate limits or availability changes, without an interactive confirmation or a separate opt-in at the moment of modification. In an agent skill context, silent persistent config changes can violate user expectations, alter future model-routing behavior, and create a confused-deputy risk if triggered indirectly by normal operation or automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes model ranking, fallback configuration, and updating openclaw.json. In addition to that, the code retrieves the OpenRouter API key from both environment variables and the OpenClaw config, and later exposes its presence/status, which is broader than simple model management behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill persists a cache of model metadata under the user's home directory without explicit warning or consent. While the cached data does not appear to include secrets, undisclosed local persistence can still create privacy and transparency issues and may retain information longer than users expect.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future version and does not guarantee a reproducible or reviewed install. This can introduce vulnerable, incompatible, or unexpected releases into the environment over time, especially since the skill appears to manage networked AI services and likely relies on HTTP requests.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Because requests is unpinned, it is not possible to determine from the manifest whether deployment will use a version affected by one of several known advisories. In a skill that interacts with external services like OpenRouter, this uncertainty matters more because HTTP client flaws can expose credentials, weaken transport guarantees, or mishandle redirects and authentication.

Content

No source excerpt is available for this finding.