openrouter-perplexity

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward OpenRouter web-search wrapper that uses your API key and sends search queries to OpenRouter, with no hidden persistence or destructive behavior evident.

This appears reasonable to install if you intend to use OpenRouter for web-search-style queries. Set only the OPENROUTER_API_KEY needed for this integration, avoid searching for secrets or highly sensitive data, and monitor API usage.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The API key can authorize OpenRouter account usage and may incur provider-side costs if used heavily.

Why it was flagged

The skill uses the user's OpenRouter API key to authenticate requests, which is expected for the advertised service and is not hardcoded or logged in the provided code.

Skill content

const apiKey = process.env.OPENROUTER_API_KEY; ... "Authorization": `Bearer ${apiKey}`

Recommendation

Use a revocable or limited-scope OpenRouter key if available, keep it out of logs, and monitor provider usage.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any sensitive information included in search queries may be processed by the external provider.

Why it was flagged

The script sends the provided search query or batch of queries to OpenRouter's external API, which is purpose-aligned but relevant for privacy.

Skill content

fetch("https://openrouter.ai/api/v1", { ... body: JSON.stringify({ query: queries }) })

Recommendation

Avoid putting secrets, private personal data, or confidential business information in queries unless you are comfortable sharing them with OpenRouter under its policies.