Agent skill · security · jeremylongshore
openrouter-compliance-review
Review OpenRouter integration for regulatory compliance (SOC2, GDPR,
Why this skill is useful
Provides specific compliance audit procedures and regulatory knowledge for OpenRouter that the AI wouldn't reliably generate on its own.
What it needs
Requires curl, jq, python installed locally. Requires openrouter account access. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
OpenRouter Compliance Review Overview OpenRouter is a proxy that routes requests to upstream providers (OpenAI, Anthropic, Google, etc.). Compliance depends on both OpenRouter's data handling and the selected provider's policies. Key considerations: data transit through OpenRouter infrastructure, provider-specific data retention, model selection for regulated data, and audit trail requirements. Prerequisites An OpenRouter API key (sk-or-v1-...) exported as OPENROUTERAPIKEY — see the openrouter-install-auth skill for setup Python 3.8+ with the OpenAI SDK for provider-pinned requests and the automated checker in the references curl and jq to run the Compliance Audit Script An existing OpenRouter integration to review — the audit script scans its source tree for hardcoded sk-or-v1- keys Knowledge of which regimes apply (SOC2, GDPR, HIPAA) and how your data is classified Instructions 1. Work through the four areas of the Compliance Checklist — datahandling, accesscontrol, audittrail, and providerselection — recording pass/fail per item. 2. Classify each workload with the Data Classification Matrix (Public → Internal → Confidential → Restricted/PHI) to determine allowed providers and required controls. 3. Pin regulated traffic per Provider Routing for Compliance: set provider.order plus allowfallbacks: False, then verify response.model confirms the approved provider actually served the request. 4. For data-sovereignty requirements, configure BYOK per BYOK for Data Sovereignty so inference runs on your own provider account and OpenRouter only routes. 5. Run the Compliance Audit Script: key label/limit check via GET /api/v1/auth/key, a free-tier warning (free tier is unsuitable for regulated data), and the hardcoded-key scan. 6. Document the data flow for auditors — client → OpenRouter (routing) → provider (inference) — per Enterprise Considerations. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/openrouter-compliance-review--938a9e