The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to interact with SubRouter API endpoints and standard shell utilities (mktemp, install, mkdir) to manage the authorization lifecycle. It generally enforces --max-redirs 0 to prevent credential leakage via HTTP redirects, although the video download step inconsistently uses the follow-redirects (-L) flag while transmitting the API key.
[DYNAMIC_EXECUTION]: The skill demonstrates constructing shell commands by interpolating variables derived from external API responses directly into string-based command templates (e.g., Step 1 polling). This pattern is susceptible to shell command injection if the API response contains malicious shell metacharacters (e.g., backticks or $(...)), as the examples use double-quoted strings for payload construction without sanitization.
[INDIRECT_PROMPT_INJECTION]: The skill ingests JSON data from the SubRouter API to determine authorization status, pricing, and model availability.
Ingestion points: API responses from curl calls in SKILL.md and references/provider-models.md.
Boundary markers: Absent.
Capability inventory: Shell command execution (curl, install), file system writes, and environment variable configuration.
Sanitization: Absent; although the skill uses JSON field extraction, the resulting values are immediately used in subsequent shell commands.
[PERSISTENCE]: Automatically persists API credentials in ~/.subrouter/credentials.json with restricted permissions (0600) to enable session reuse.
[PROMPT_INJECTION]: Includes instructions to mask sensitive credentials (API keys and access tokens) from the agent's output and logs. While this involves concealing data from the user transcript, it is implemented as a defensive measure to prevent credential leakage in session history.

subrouter