Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it sends user prompts to OpenRouter free models using an OpenRouter API key, with no hidden persistence or unrelated behavior found.
Install only if you are comfortable sending the prompts you use with this skill, and any optional system guidance, to OpenRouter and downstream model providers. Do not use it with secrets or private data unless that matches your OpenRouter data-handling expectations.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
completion = as_decimal(pricing.get("completion"))
if prompt is None or completion is None:
return False
return prompt == Decimal("0") and completion == Decimal("0")
def get_context_score(context_length: Any) -> int:
The skill invokes a Python script that requires an API key from the environment and makes outbound network requests, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch reduces transparency and weakens policy enforcement, making it easier for a caller to invoke code with broader capabilities than reviewers or runtime controls expect.
The script sends the user-provided prompt and optional system instruction directly to OpenRouter-hosted third-party models, but the script itself provides no explicit user-facing disclosure, consent prompt, or warning at the point of transmission. In a skill whose purpose is external LLM routing, this is expected behavior, but it still creates a real privacy and data-handling risk if callers assume prompts stay local or may include secrets.