openrouter-usage-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the OpenRouter API to track costs and usage metrics. This creates an interface where externally sourced data enters the agent's context.
- Ingestion points: Data is fetched from
https://openrouter.ai/api/v1/generationandhttps://openrouter.ai/api/v1/auth/keywithinSKILL.md. - Boundary markers: There are no explicit instructions or delimiters used to separate API response data from the rest of the agent's prompt context.
- Capability inventory: The skill possesses the ability to execute shell commands via
Bash(Python, curl, jq) and write files, as specified in theallowed-toolsfrontmatter. - Sanitization: The skill parses JSON responses and extracts specific fields without broad sanitization of the content before it is processed or logged.
Audit Metadata