ai-integrations-openrouter
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: An automated scan flagged a potential remote code execution pattern in
SKILL.md. Manual review of the evidence confirms that the command (curl -s https://openrouter.ai/api/v1/models | grep -o '"id":"[^"]*<model_name>[^"]*"' | sed ...) is a data-parsing operation intended to extract model identifiers from the official OpenRouter API. It does not pipe output to a shell or execute downloaded content as code. - [COMMAND_EXECUTION]: The skill includes instructions to use standard shell utilities like
grep,sed,cp, andpnpm. These are used for routine development tasks such as project file management, dependency installation, and configuration parsing within the local environment. - [EXTERNAL_DOWNLOADS]: The skill references and fetches data from
openrouter.ai. This is the official domain for the well-known OpenRouter service and is the primary target of this integration; the connection is used only for retrieving model metadata and performing chat completions. - [CREDENTIALS_UNSAFE]: The skill correctly manages credentials using environment variables (
AI_INTEGRATIONS_OPENROUTER_API_KEY). It explicitly instructs the agent not to hardcode secrets or ask the user for them, following security best practices for credential management.
Audit Metadata