The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes common shell utilities to interact with API endpoints and perform calculations.
Evidence: Use of curl, jq, and bc in SKILL.md to query credit balances and evaluate budget thresholds.
[CREDENTIALS_UNSAFE]: The skill correctly handles sensitive API credentials using environment variables.
Evidence: References to OPENROUTER_API_KEY and OPENROUTER_MGMT_KEY via os.environ and standard shell environment access.
[PROMPT_INJECTION]: The skill ingests data from the OpenRouter API to track usage and enforce budgets, which is an indirect injection surface.
Ingestion points: API responses from https://openrouter.ai/api/v1/auth/key and https://openrouter.ai/api/v1/generation are used to update local tracking state.
Boundary markers: The skill primarily uses these inputs for arithmetic calculations and logical branching rather than direct prompt interpolation.
Capability inventory: The skill performs network requests via curl and requests, and writes tracking data to a local file (cost_tracking.json).
Sanitization: External usage data is converted to numeric types (float, int) before being used in budget calculations, mitigating potential injection through malformed API responses.

openrouter-cost-controls