Security audit

Updating OpenRouter Free Models

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent model-update purpose, but it can expose the wrong API token and makes persistent live agent configuration and service changes with weak safeguards.

Review carefully before installing. Use only an OpenRouter-scoped API key, do not rely on ANTHROPIC_AUTH_TOKEN, back up ~/.claude/settings.json and ~/.openclaw/openclaw.json, avoid complete_test.sh on a live setup, inspect /tmp/verified_models.txt before applying, and confirm any OpenClaw restart manually.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: test_models.py:14
Finding: Cross-Provider API Credential Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: fetch_models.py:67
Finding: Predictable Shared Temporary Files Allow Symlink and Workflow-Result Manipulation
Content: View full analysis
line.trim().length > 0); ``` ### Technical Analysis The workflow exchanges security-relevant data through fixed, globally predictable paths in `/tmp`. It does not create a private working directory, verify file ownership, verify that each pa ...[truncated 2914 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: complete_test.sh:25
Finding: Installation Test Mutates Live OpenClaw Configuration Without Explicit Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 258)May include surrounding context.
bash
cd ~/.openclaw/workspace/skills/updating-openrouter-free-models # Optional: clean old cache rm -f /tmp/free_models.txt /tmp/verified_models.txt /tmp/failed_models.txt # Run full update python3 fetch_models.py && python3 test_models.py && node apply_updates_openclaw.js # Restart

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 91% confidence
Finding: This documentation directs interaction with sensitive agent configuration paths under the user's home directory. In the context of an install/update skill, access to ~/.claude/settings.json and ~/.openclaw/openclaw.json is security-relevant because these files control model/provider behavior and can be altered to change agent operation or break service availability.
Content: Scanner excerpt · README.md (reported line 127)May include surrounding context.
./restart_openclaw.sh

5. Validate

python3 -m json.tool ~/.claude/settings.json # Claude python3 -m json.tool ~/.openclaw/openclaw.json # OpenClaw

text

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill’s declared purpose is configuration maintenance, but it also directs service management actions including restarting OpenClaw, interacting with launchctl, killing processes, and spawning background services. Hidden operational side effects increase risk because an agent or user may approve a config-update workflow without realizing it includes system-level process control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill’s declared purpose is configuration maintenance, but it also directs service management actions including restarting OpenClaw, interacting with launchctl, killing processes, and spawning background services. Hidden operational side effects increase risk because an agent or user may approve a config-update workflow without realizing it includes system-level process control.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 97% confidence
Finding: The skill targets ~/.claude/settings.json, a sensitive agent configuration file that influences model availability and behavior. Writing to agent config directories is security-relevant because it can persistently alter how the assistant operates, potentially causing denial of service, misrouting, or unsafe defaults if abused or performed incorrectly.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
")

text
Then manually or programmatically insert into `~/.claude/settings.json`. ### Step 4: Update OpenClaw Configuration

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · INSTALLATION.md (reported line 188)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 160)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 215)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 348)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 363)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 521)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 576)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 709)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 724)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
md
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · apply_updates.py (reported line 22)May include surrounding context.
python
return False, str(e) def update_claude_settings(verified_models): """Update ~/.claude/settings.json with verified models.""" settings_path = Path.home() / '.claude' / 'settings.json' if not settings_path.exists():

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to apply configuration changes and restart a running service without an explicit warning that this modifies user state and may interrupt availability. In a skill context, this can lead to unintended downtime or accidental overwriting of a user's working configuration, especially if followed blindly or automated by an agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The one-command workflow hides several state-changing operations behind a single command, including testing, config modification, and restart behavior, without warning the user. This increases the risk that a user or agent executes it without understanding its side effects, causing unexpected service interruption or configuration drift.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README prominently describes automated configuration changes and service restarts as core behavior but does not provide an upfront safety warning about modifying local agent config files and disrupting running services. In an agent-executed workflow, this can lead users or downstream agents to perform impactful actions without informed consent, increasing the chance of unintended local misconfiguration or service interruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation prompts are written for an AI agent and instruct it to create directories, copy files, change permissions, and execute scripts and tests, but they omit explicit warnings about filesystem writes, network access, and execution side effects. This is dangerous because agentic installers can perform these actions automatically, potentially altering user environments and running unreviewed code with little friction.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs use of shell commands, environment-based secrets, and reads/writes user configuration files, yet it declares no tool scope or permission boundary. This creates an overbroad execution surface where an agent may perform sensitive actions without explicit capability disclosure or user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions modify ~/.claude/settings.json and ~/.openclaw/openclaw.json without clear backup, diff review, or confirmation guidance. Direct edits to agent configuration can break tooling, alter model routing, or persist unintended settings changes if the generated model list or update logic is wrong.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The script persistently overwrites agent configuration based on unvalidated content from /tmp/verified_models.txt, causing long-lived changes to future tool behavior. Because /tmp is a shared, world-writable location on many systems, another local process could tamper with that file and inject arbitrary model IDs into the user's Claude/OpenClaw config, leading to persistent misconfiguration or redirection to unintended providers/models.
Content: Scanner excerpt · apply_updates.py (reported line 39)May include surrounding context.
python
config['model'] = primary config['availableModels'] = verified_models # Write with proper formatting with open(settings_path, 'w') as f: json.dump(config, f, indent=2) f.write('\n')

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tool Parameter Abuse

Agent Config Directory Access

5. Validate

Tp4

Tp4

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Session Persistence