openrouter-function-calling
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-turn tool execution loop where the agent performs actions based on LLM-generated tool calls. This pattern is inherently susceptible to indirect prompt injection if the agent processes untrusted data (e.g., website content or database results) that could contain instructions to trigger tools maliciously.
- Ingestion points: The skill ingests model-generated content via
response.choices[0].message.tool_callsinSKILL.mdandreferences/examples.md. - Boundary markers: The provided code examples do not explicitly demonstrate the use of boundary markers or delimiters for separating instructions from processed data.
- Capability inventory: The skill provides a dispatcher (
execute_tool) and router (ToolRouter) for executing code based on LLM output. While the provided examples use mock functions, a real-world implementation would likely include network or file system capabilities. - Sanitization: The skill's 'Enterprise Considerations' section correctly advises validating tool arguments server-side before execution to mitigate hallucinations and injection risks.
- [EXTERNAL_DOWNLOADS]: The documentation instructs users to install the
openaipackage via standard package managers (pip and npm). These are well-known, official libraries from a recognized organization.
Audit Metadata