Skills toolrouter
📦

toolrouter

Content revision r1 Safe ⚙️ External commands🌐 Network access

Discover and Run ToolRouter Operations

External tasks require finding compatible tools, checking access, and tracking results. This skill guides those steps through one connected ToolRouter MCP server.

Supports: Claude Codex Code(CC)
📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "toolrouter" from https://skillstore.io/skills/humanleap-toolrouter.md and its manifest at https://skillstore.io/api/skills/humanleap-toolrouter/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/humanleap-toolrouter.md Signed manifest GET /api/skills/humanleap-toolrouter/manifest Signed lockfile GET /api/skills/humanleap-toolrouter/lockfile

Test it

Using "toolrouter". Discover search tools without spending credits.

Expected outcome:

  • Operation review: available schemas, account requirements, and prices are summarized before execution.
  • Execution status: no paid operation requested.

Using "toolrouter". Generate an image within the approved budget.

Expected outcome:

  • A completed result includes the asset link and verified job status.
  • A pending result reports the outstanding job, rather than claiming the image is ready.

Using "toolrouter". Retrieve economic data for a selected country.

Expected outcome:

  • The result identifies the statistical source, observation period, units, and country.
  • Coverage gaps and provider limitations remain visible alongside the retrieved values.

Security Audit

Safe
v1 • 10/3/2026 Open versioned report

One finding confirms supply-chain exposure from the unpinned remote installation command. The other eighteen findings are Markdown identifiers, legitimate service links, or account authorization checks, not shell execution or system reconnaissance. No evidence found of prompt injection, credential exfiltration, or malicious intent in the reviewed files; the hosted service was not assessed.

2
Files scanned
133
Lines analyzed
1
Review items
0
False positives ignored
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:13
Ruby/shell backtick execution
Install this skill with `pnpm dlx skills add Humanleap/agent-skills --skill toolrouter`. Connect the
The documented pnpm dlx command downloads and executes an unpinned installer, and the skill repository reference is also unpinned. This creates supply-chain exposure, although the backticks themselves are Markdown, not Ruby execution.

Risk Factors

⚙️ External commands (12)
SKILL.md:13 SKILL.md:24 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:43 SKILL.md:51
🌐 Network access (5)
SKILL.md:4 SKILL.md:13 SKILL.md:57 SKILL.md:58 SKILL.md:59
Audited by: codex
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/humanleap-toolrouter/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/humanleap-toolrouter/security.svg)](https://skillstore.io/skills/humanleap-toolrouter?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/humanleap-toolrouter?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/humanleap-toolrouter/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/humanleap-toolrouter.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

humanleap. (2026). toolrouter security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/humanleap-toolrouter/audits/1

BibTeX citation

@techreport{humanleap-humanleap-toolrouter-2026, author = {humanleap}, title = {toolrouter security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/humanleap-toolrouter/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "toolrouter security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "humanleap" date-released: "2026-10-03" url: "https://skillstore.io/skills/humanleap-toolrouter/audits/1" identifiers: - type: other value: "skillstore:humanleap-toolrouter:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Compare Search and SEO Evidence

Discover search and keyword operations, gather source links, and retain market, date range, and measurement limitations.

Produce Approved Media Assets

Find an available media operation, check its price, and track the job until completed asset links are available.

Retrieve Company and Economic Data

Select registry or statistical operations and report results with source dates, units, geography, and access limitations.

Try These Prompts

Find an Available Search Tool 
Use my connected ToolRouter server to discover web search operations. Report available schemas and access requirements without executing paid operations.
Research Keyword Demand 
Research keyword demand for electric bicycles in the United Kingdom through ToolRouter. Check schemas and prices, request spending approval, and retain provider limitations.
Generate and Verify an Image 
Generate one square product image through an available ToolRouter operation, within my approved $2 budget. Verify job completion and return the asset link.
Publish an Authorized Social Post 
Publish my approved launch text to the connected X account I specified. Verify its identity and operation schema; check uncertain status before retrying.

Best Practices

  • Inspect the live operation schema, account access, and price before execution.
  • Keep credentials in the client credential store and confirm authority for account changes, publishing, and spending.
  • Track asynchronous jobs and verify uncertain writes before retrying or reporting success.

Avoid

  • Inventing operation names or treating provider listings as proof of account access.
  • Changing providers, connecting accounts, or spending credits without task authority.
  • Repeating uncertain writes or reporting queued jobs as completed results.

Frequently Asked Questions

Which assistants can use this skill?
The skill targets Claude, Codex, and Claude Code. The client must support the connected remote MCP server and its authentication flow.
Does the skill work without ToolRouter?
No. It guides ToolRouter operations and requires a connected server exposing the needed tools.
Are all listed providers available to my account?
No. Provider references describe integrations, while live schemas and your client profile determine available operations and account requirements.
Can operations cost money?
Yes. Inspect operation prices and available credits, then obtain task-specific spending authority before paid execution.
Can it publish to X or LinkedIn?
It guides supported publishing operations when available. Confirm the connected account, authorized content, and live schema before posting.
How should credentials and installation be handled?
Keep tokens in the client credential store. Review downloaded installation code and prefer pinned installer versions and immutable skill revisions.

Developer Details

Author

humanleap

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/humanleap/agent-skills/tree/1eaefe1e9bc4f006ccce55793eb98055619e9a5d/skills/toolrouter

Ref

f34d6380f82ea59b1965530a3bc0b1bc54c25f91

Maintenance freshness

10/3/2026

Usage

0 downloads · 0 views

File structure

📁 references/

📄 providers.md

📄 SKILL.md