openrouter-team-setup
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Bash(python3:*),Bash(curl:*), andBash(jq:*)to interact with the OpenRouter Management API for provisioning keys and checking usage stats. These operations are restricted to the officialopenrouter.aidomain and standard environment variables (OPENROUTER_MGMT_KEY). - [DATA_EXFILTRATION]: While the skill accesses API keys and usage data, this is the primary functionality for the intended purpose of team management. It lacks any patterns indicating the exfiltration of this data to unauthorized third-party servers; all data is managed locally (SQLite) or sent to the official OpenRouter API.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to use environment variables (
OPENROUTER_MGMT_KEY,OPENROUTER_API_KEY) rather than hardcoding secrets. It includes a reference to best practices for environment-specific key separation.
Audit Metadata