openrouter-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by the official OpenRouter team and interacts exclusively with the OpenRouter API at
https://openrouter.ai. All network operations are restricted to this well-known vendor domain. - [DATA_EXPOSURE]: The skill processes the
OPENROUTER_API_KEY(management key) required for analytics access. The scripts correctly read this sensitive value from environment variables or command-line arguments and transmit it only to the verified OpenRouter endpoint using standard Bearer token authentication. - [INDIRECT_PROMPT_INJECTION]: The skill ingests usage data from the OpenRouter API. While this constitutes an ingestion of external data, the content consists of structured usage metrics (costs, token counts, timestamps) and human-readable identifiers (model names, app titles). The scripts pass this data directly to the agent as JSON. The risk of malicious instructions being embedded in these specific metric fields is negligible in the context of usage analytics.
- [COMMAND_EXECUTION]: The skill includes TypeScript scripts that are executed via
tsx. These scripts perform legitimate data fetching and CLI argument parsing related to the skill's stated purpose of analytics reporting.
Audit Metadata