Free Ride 1

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

FreeRide appears purpose-built for OpenRouter model routing, but it can persistently change OpenClaw's default AI model behavior and uses a mutable remote installer, so users should review it before installing.

Install only if you are comfortable letting this skill change your OpenClaw default model and fallbacks, store model cache/state under `~/.openclaw`, and send your OpenRouter key to OpenRouter. Prefer reviewing the exact installer version, backing up `~/.openclaw/openclaw.json`, and running commands manually before using daemon mode.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:40

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: skill.json:40
Additional Location: README.md:50-52
Vulnerability Type: Supply-chain risk caused by executing a mutable package version
Risk Level: Medium

Vulnerable Code

skill.json:40:

json

"install": "npx clawhub@latest install freeride && cd ~/.openclaw/workspace/skills/free-ride && pip install -e ."

README.md:50-52:

bash

npx clawhub@latest install free-ride
cd ~/.openclaw/workspace/skills/free-ride
pip install -e .

Technical Analysis

The installation procedure invokes npx clawhub@latest. The latest tag is mutable, so the package downloaded and executed at installation time can differ from the package that existed when this Skill was audited. Because npx executes package-provided code, compromise of the npm package, publisher account, release process, or dependency chain could result in arbitrary code execution.

No exact package version, integrity hash, or lockfile constrains the executable installer. There is also an identifier inconsistency: skill.json installs freeride, while the README installs free-ride. This could cause unintended package or Skill resolution, depending on the installer's behavior.

The local pip install -e . step installs the audited project itself and requests>=2.31.0; no custom setup-time payload was found in setup.py. The principal confirmed risk is the mutable remote package executed through npx.

Attack Path

1. An attacker compromises the clawhub npm publisher account, package release pipeline, registry resolution path, or a dependency used by a future release.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user follows the documented installation command or the metadata-driven installer runs it.
4. npx downloads and executes the changed package before the user can verify its contents.
5. The maliciou ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed version, for example clawhub@X.Y.Z.
2. Verify the downloaded package using registry integrity metadata or a separately published cryptographic checksum.
3. Use lockfiles where applicable and review transitive dependency changes before updating the installer.
4. Standardize the Skill identifier so both metadata and documentation consistently use the intended slug.
5. Avoid automatically executing remotely resolved installer code when a locally reviewed installation method is available.
6. Pin Python dependencies to reviewed versions or constrained compatible ranges and use hashes for reproducible deployments.
7. Document the external code-execution boundary so users understand that the npm installer is not part of the audited artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 74)May include surrounding context.

python

}

    try:
        response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        return data.get("data", [])

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

### Stop paying for AI. Start riding free.

[![ClawHub Downloads](https://api.clawhub-badge.xyz/badge/free-ride/downloads.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Current Installs](https://api.clawhub-badge.xyz/badge/free-ride/installs-current.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Stars](https://api.clawhub-badge.xyz/badge/free-ride/stars.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Version](https://api.clawhub-badge.xyz/badge/free-ride/version.svg)](https://clawhub.ai/skills/free-ride)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 6)May include surrounding context.

md

### Stop paying for AI. Start riding free.

[![ClawHub Downloads](https://api.clawhub-badge.xyz/badge/free-ride/downloads.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Current Installs](https://api.clawhub-badge.xyz/badge/free-ride/installs-current.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Stars](https://api.clawhub-badge.xyz/badge/free-ride/stars.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Version](https://api.clawhub-badge.xyz/badge/free-ride/version.svg)](https://clawhub.ai/skills/free-ride)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

### Stop paying for AI. Start riding free.

[![ClawHub Downloads](https://api.clawhub-badge.xyz/badge/free-ride/downloads.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Current Installs](https://api.clawhub-badge.xyz/badge/free-ride/installs-current.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Stars](https://api.clawhub-badge.xyz/badge/free-ride/stars.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Version](https://api.clawhub-badge.xyz/badge/free-ride/version.svg)](https://clawhub.ai/skills/free-ride)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

md

### Stop paying for AI. Start riding free.

[![ClawHub Downloads](https://api.clawhub-badge.xyz/badge/free-ride/downloads.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Current Installs](https://api.clawhub-badge.xyz/badge/free-ride/installs-current.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Stars](https://api.clawhub-badge.xyz/badge/free-ride/stars.svg)](https://clawhub.ai/skills/free-ride)
[![ClawHub Version](https://api.clawhub-badge.xyz/badge/free-ride/version.svg)](https://clawhub.ai/skills/free-ride)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes automatic model discovery, ranking, fallback configuration, and config preservation, but it does not clearly warn users that the tool will contact external services and modify ~/.openclaw/openclaw.json. In a skill that changes agent behavior and routing, lack of disclosure increases the risk of users making security-relevant changes without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest remote package without pinning to a specific version. This creates a supply-chain risk: a compromised upstream package or malicious update could cause arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The quick-start asks users to export or store an OpenRouter API key in configuration without any warning about secret handling, persistence, or the fact that requests will be sent to a third-party provider. This can lead to accidental credential exposure in shell history, shared environments, or config files with overly broad permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The watcher daemon is described as continuously monitoring for rate limits and automatically rotating models, yet the README does not warn users that it may run persistently and perform ongoing automatic configuration changes. Persistent background automation is more dangerous in this skill context because it can silently alter model selection and continuously interact with external services over time.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to read environment state, install a package, modify ~/.openclaw/openclaw.json, and restart the OpenClaw gateway, but it declares no explicit tool scope or permissions boundary. That creates a capability mismatch: an agent could perform filesystem, environment, and network-affecting actions without clear user-visible restriction, increasing the chance of unintended or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger text is broad enough to match many ordinary conversations about AI costs, model switching, or rate limits, which could invoke the skill in situations where the user did not intend configuration changes. Because the skill's primary workflow performs persistent config modification and service restart, over-triggering materially increases the risk of unwanted system changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells the agent to change the user's OpenClaw configuration and restart the gateway as the default workflow, but it does not prominently warn about those persistent and service-affecting changes before execution. In context, this is risky because it alters model routing behavior, may disrupt active sessions, and could install software or overwrite operational preferences without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes ranking free OpenRouter models, configuring fallbacks, and updating openclaw.json. This function additionally searches for credentials in process environment and config data, which is a more sensitive capability than simple model/config management and is not explicitly disclosed in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill writes directly to the user's OpenClaw configuration file, changing primary and fallback models without any confirmation prompt, backup, or transactional safeguard. In a CLI context this can silently alter user behavior, break existing configuration, or redirect future model usage in ways the user did not intend.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the most recent published package at install time rather than a reviewed, pinned version. That creates a supply-chain execution risk: if the package is compromised, typo-squatted, or updated maliciously, arbitrary code would run during installation in the user's environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · watcher.py (reported line 98)May include surrounding context.

python

}

    try:
        response = requests.post(
            OPENROUTER_CHAT_URL,
            headers=headers,
            json=payload,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The function persists fetched model data to ~/.openclaw/.freeride-cache.json, creating a local file as a side effect of normal execution. There is no warning in the function or its docstring that the skill stores API-derived data on disk, so users may not realize local files are being created and updated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified as requests>=2.31.0, which permits installation of any future version and does not guarantee a reproducible or reviewed build. This can introduce supply-chain risk or unexpected vulnerable versions during installation, especially for a skill that performs network operations against external services.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version includes fixes for known advisories affecting older releases. In a skill that manages OpenRouter access and likely makes outbound HTTP requests, an unverified HTTP client dependency increases the chance of credential leakage, TLS-related issues, or other request-handling flaws if a bad version is resolved.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This manifest lists commands such as "list", "switch", "auto", "status", and "refresh" without any narrowing context or negative examples. In a manifest file, such generic invocation terms can be ambiguous and overlap with common command vocabulary, increasing the risk of unintended invocation or unclear routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.