Free Ride Xiaoshu

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it handles API keys and OpenClaw configuration changes in ways users should review before installing.

Install only if you are comfortable letting this skill modify your OpenClaw model configuration and call OpenRouter with your API key. Do not print or paste the API key; use a non-printing presence check instead. Back up ~/.openclaw/openclaw.json before running mutating commands, avoid the watcher unless you want automatic model changes, and prefer pinned or isolated installation where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

API Key Disclosed Through Terminal Output

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.json:41

Finding

Mutable and Unpinned Installation Dependencies

Content

View full analysis

=2.31.0", ], ``` `requirements.txt`: ```text requests>=2.31.0 ``` ### Technical Analysis The installation procedure invokes the mutable `clawhub@latest` npm distribution rather than a reviewed version. The Python dependency uses an open-ended minimum version, allowing package resolution to select a future `requests` release that was not part of this audit. No lockfile, package hashes, or integrity metadata constrain the artifacts that will be installed. Consequently, the effective installation dependency set can change without any modification to the audited Skill repository. This is a supply-chain weakness rather than evidence that the current `requests` package or ClawHub release is malicious. ### Attack Path 1. A user follows the documented installation command. 2. `npx` resolves `clawhub@latest` at installation time from the configured npm registry. 3. `pip install -e .` resolves an arbitrary compatible `requests` version at installation time. 4. If an upstream account, package release, registry, mirror, or dependency resolution path is compromised, a malicious artifact can be returned. 5. Package installation code or subsequently imported dependency code executes with the privileges of the installing user. ### Impact Assessment A compromised installation dependency could execute code under the installing user's account. That scope may include reading user-accessible files, accessing e ...[truncated 371 chars]

Remediation

View remediation

install freeride ``` - Pin Python dependencies to reviewed versions rather than open-ended ranges. - Generate and distribute a lockfile containing cryptographic hashes. - Install with hash verification where supported, such as: ```bash pip install --require-hashes -r requirements.txt ``` - Use only trusted package registries and document their expected URLs. - Add automated dependency vulnerability scanning and controlled update review. - Avoid privileged installation; install inside an isolated virtual environment under a non-administrative account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:193

Finding

Malformed OpenClaw Configuration Can Be Silently Overwritten

Content

View full analysis

dict: """Load OpenClaw configuration.""" if not OPENCLAW_CONFIG_PATH.exists(): return {} try: return json.loads(OPENCLAW_CONFIG_PATH.read_text()) except json.JSONDecodeError: return {} def save_openclaw_config(config: dict): """Save OpenClaw configuration.""" OPENCLAW_CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) OPENCLAW_CONFIG_PATH.write_text(json.dumps(config, indent=2)) ``` Mutating commands subsequently pass the returned object through configuration initialization and save it, including: ```python config = load_openclaw_config() config = ensure_config_structure(config) ``` ### Technical Analysis When `~/.openclaw/openclaw.json` exists but contains malformed or partially written JSON, `load_openclaw_config()` silently treats it as an empty configuration. Mutating commands can then construct only the model-related structure and write that object over the original file. This behavior contradicts the stated guarantee that unrelated gateway, channel, plugin, environment, custom instruction, and named-agent settings are preserved. The write is also performed directly against the destination instead of using a validated temporary file and atomic replacement. There is no backup or file locking. An ordinary interrupted write, manual syntax error, concurrent writer, storage problem, or deliberate low-privilege modification could trigger destructive replacement. ### Attack Path 1. The existing `~/.openclaw/openclaw.json` becomes malformed through an interrupted write, concurrent modification, manual editing error, or deliberate tampering. 2. The user runs a mutating command such as `freeride auto`, `freeride switch`, or `freeride fallbacks`. 3. `load_o ...[truncated 856 chars]

Remediation

View remediation

dict: if not OPENCLAW_CONFIG_PATH.exists(): return {} try: return json.loads(OPENCLAW_CONFIG_PATH.read_text()) except json.JSONDecodeError as exc: raise RuntimeError( f"Refusing to modify invalid configuration: {OPENCLAW_CONFIG_PATH}" ) from exc ``` - Create a backup before every configuration mutation. - Validate the complete resulting configuration against the expected OpenClaw schema. - Write to a temporary file in the same directory, flush and synchronize it, then atomically replace the destination with `os.replace()`. - Preserve restrictive file permissions and avoid making credential-containing configuration readable by other users. - Use file locking to prevent concurrent writers from corrupting or losing updates. - Report parsing and validation errors clearly without printing secrets from the configuration. - Add regression tests confirming malformed input is never overwritten and unrelated configuration keys remain unchanged. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 74)May include surrounding context.

python

}

    try:
        response = requests.get(OPENROUTER_API_URL, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
        return data.get("data", [])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README emphasizes one-command setup and automatic fallback/model rotation, but does not prominently warn before installation/use that the tool will modify ~/.openclaw/openclaw.json and may switch models automatically during operation. This can lead to unintended configuration drift, surprising runtime behavior, and trust/safety issues if users rely on a specific model or provider.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest install freeride, which pulls and executes the latest package version at install time without pinning to a known-good release. This creates a supply-chain risk: if the upstream package is compromised or a malicious update is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill directs the agent to read environment variables, install software, modify configuration files, and use network-backed services, but it declares no explicit tool scope or permission boundaries. That increases the chance the skill can be invoked with more authority than intended, making unintended file changes, credential access, or external calls harder to constrain or audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text includes broad triggers like 'free AI,' 'model switching,' 'rate limits,' and 'reduce AI costs,' which could cause the skill to activate for ordinary discussion rather than a clear request to reconfigure local tooling. In this skill, activation can lead to config changes, package installation guidance, and service restarts, so overbroad matching raises the risk of unwanted operational changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to echo and persist an API key without emphasizing that the credential is sensitive, which can normalize unsafe handling and increase the risk of disclosure through shell history, screenshots, shared terminals, or stored configuration. Because the skill also encourages writing the key into application config, the exposure surface expands if file permissions or backup practices are weak.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code path persists changes to the user's OpenClaw configuration, altering primary and fallback models, but there is no confirmation prompt before the write occurs. Although some status messages are printed, they happen after the decision to modify state and do not warn the user that a config file will be overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The fallbacks command writes a new fallback list directly into the user's configuration file, replacing existing fallback settings, but only informs the user after the write. For a safety-relevant file modification, the code lacks a prior disclosure or confirmation that existing configuration may be changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest requires an OPENROUTER_API_KEY environment variable but provides no warning about how the credential is stored, used, or transmitted. In a skill that manages model routing and remote API access, this increases the risk that users provide sensitive credentials without understanding exposure paths, logging behavior, or third-party transmission.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The install command invokes npx clawhub@latest, which fetches and executes the latest published package at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users installing the skill may execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · watcher.py (reported line 98)May include surrounding context.

python

}

    try:
        response = requests.post(
            OPENROUTER_CHAT_URL,
            headers=headers,
            json=payload,

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future version and does not ensure reproducible installs. This can introduce vulnerable or breaking releases into the environment over time, especially for a skill that may make network requests to external services.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest includes requests without pinning to a specific version, so it is impossible to verify from this file whether installation will resolve to a release affected by known CVEs. In a skill that manages AI model access over the network, use of an affected HTTP client could expose credentials, weaken request validation, or otherwise increase risk when interacting with external endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The install command performs package installation, directory changes, and pip install -e . without any explicit warning that it will modify the local environment. Because skill installation commonly runs with the user's permissions and may alter Python packages or workspace state, lack of disclosure increases the chance of unsafe execution and reduces informed consent around system changes.

Content

No source excerpt is available for this finding.