liter-llm
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs multiple components from official vendor-owned sources.
- Fetches binaries and source code from the author's GitHub repository:
https://github.com/xberg-io/liter-llm. - Downloads Docker images from the GitHub Container Registry:
ghcr.io/xberg-io/liter-llm. - Installs language-specific packages from standard registries (NPM, PyPI, Rubygems, etc.) under the
@xberg-ioorganization or matching package names. - [COMMAND_EXECUTION]: The documentation provides instructions for executing CLI commands to manage LLM interactions and proxy services.
- Includes commands for package managers (
npm,pip,cargo,brew) and runtime execution (npx,uvx). - Mentions a local launch script
scripts/mcp-launch.shfor auto-registering the Model Context Protocol (MCP) server. - [CREDENTIALS_UNSAFE]: The skill handles sensitive API keys for multiple LLM providers.
- Demonstrates safe practice by reading keys from environment variables (e.g.,
os.environ["OPENAI_API_KEY"]) rather than hardcoding them. - Explicitly mentions that keys are wrapped in
SecretStringtypes to prevent accidental logging or serialization.
Audit Metadata