openrouter-function-calling

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation and examples demonstrate communication with the OpenRouter API (https://openrouter.ai/api/v1). This is standard behavior for an API integration skill. The skill correctly instructs users to manage sensitive credentials via environment variables (OPENROUTER_API_KEY) rather than hardcoding them.
  • [INDIRECT_PROMPT_INJECTION]: This skill implements an interface for automated tool execution, which inherently creates an indirect prompt injection surface.
  • Ingestion points: Untrusted data enters the agent context via the tool_calls field in the model response (found in SKILL.md and references/tool-router.md).
  • Boundary markers: The implementation uses a function-name whitelist (TOOLS dictionary in SKILL.md and the ToolRouter registration pattern) which prevents the model from calling arbitrary functions not explicitly defined by the developer.
  • Capability inventory: The skill environment is configured with wide Bash access (Bash(python3:*)), and the provided logic executes code based on model-provided arguments.
  • Sanitization: The examples do not show explicit sanitization of tool arguments (e.g., shell escaping), relying on the developer to implement safe handlers for the registered functions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 09:34 PM
Security Audit — agent-trust-hub — openrouter-function-calling