ClawHub
Back to skill

Security audit

Free Ride

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for OpenRouter model management, but it deserves review because it can persistently change OpenClaw's active model configuration and run a background watcher.

Install only if you are comfortable allowing this skill to change your OpenClaw default model and fallback chain, use your OpenRouter API key, and make live OpenRouter requests. Back up ~/.openclaw/openclaw.json first, store the API key carefully, and run freeride-watcher only if you want an unattended process that keeps probing and rotating models.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
The skill's public description understates its operational behavior: beyond simple model selection, it performs live remote probes, can run a persistent watcher, and automatically rewrites OpenClaw configuration over time. This matters because users may grant trust based on a narrow description while the skill effectively gains ongoing networked control over model routing and persistent local state.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README instructs users to place an OpenRouter API key directly into environment variables or persistent OpenClaw configuration without any warning about secret handling, shell history exposure, file permissions, or avoiding committing config files. This can lead to credential leakage through dotfiles, process inspection, screenshots, backups, or accidental source control inclusion.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script writes directly to the user's OpenClaw configuration file, which can silently alter the active model, fallback chain, and auth-related settings without backup, diff, or confirmation. In an agent-skill context that may be invoked automatically, this creates a meaningful integrity risk because a misfire or maliciously triggered invocation can persistently change local configuration.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The rotate/test path performs live outbound requests to OpenRouter to probe models, but the user is not explicitly warned at execution time that external network calls will be made. Although the hardcoded probe prompt is minimal ('Hi') and does not exfiltrate user conversation content, undisclosed network activity from a local skill still has privacy, policy, and cost implications.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill exposes several broad command triggers such as 'list', 'switch', 'auto', 'status', and 'refresh' without any activation constraints, namespace prefixing, or negative examples. In an agent ecosystem, this can cause accidental invocation from ordinary user language, leading the skill to modify OpenClaw configuration or switch models when the user did not explicitly request it.

Session Persistence

Medium
Category
Rogue Agent
Content
freeride-watcher

# Persistent background
nohup freeride-watcher > ~/.openclaw/freeride-watcher.log 2>&1 &

# One-shot check (no loop)
freeride-watcher --once
Confidence
82% confidence
Finding
nohup

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
Confidence
95% confidence
Finding
requests>=2.31.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
main.py:102

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:71