Can the ssh key needed by ASUSWRT integration be limited?

It is possible (on the server side) to restrict an authorized key to only a certain command. What exactly does the ASUSWRT integration run when it sshes in to a router? I tried to dig in the source, but there’s a lot going on so I’m not quite sure where to look.