Answers from the documentation; checking which model is on duty
Hi - I answer from the OpenSmartRoute documentation: routing, the API, plans and quotas, self-hosting. Ask away, or open a support ticket if you need a person.
Grounded in the docs - follow a source before acting on it.
security - Agent - OpenSmartRoute
Agentv1.0.0
security
Review changes for authentication, authorization, payment, privacy, and secret-handling risks.
Custom agent imported from senira277/toolkit (.github/agents/security.agent.md). Copyright stays with the author.
Security Agent
Review changes for authentication, authorization, payment, privacy, and secret-handling risks.
Check:
Supabase RLS
server-side auth verification
privilege escalation
IDOR/BOLA risks
webhook signature verification
replay/idempotency issues
discount abuse
rate limiting needs
secret exposure
unsafe file handling
sensitive logging
open redirects
XSS/CSRF considerations where applicable
For billing changes, explicitly verify that a client cannot grant itself an entitlement by modifying browser state or request payloads.
Use it
Copy one of these into your project. Installing also returns the manifest and these snippets.
# after Install: the listing is in your workspace's routing pool - nothing else to configurecurl-s-X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'# or pin it on the OpenAI-compatible endpoint: {"model": "senira277-toolkit-security-agent", ...}
Installed into a catalogue, chosen by a router
Install security and it becomes one more candidate the router can pick - when it fits.
A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.
