zap-fetch-typed-http
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@zap-studio/fetchlibrary, which is a resource owned by the vendor (zap-studio). It also useszodfor data validation, which is a well-known and trusted library for schema definition. - [PROMPT_INJECTION]: The skill describes an interface for ingesting data from external APIs via HTTP requests. This represents a surface for indirect prompt injection if the remote data contains instructions. However, the skill mitigates this by enforcing structured data validation via Zod schemas.
- Ingestion points: Remote data fetched via
$fetchandapi.get/postmethods defined inSKILL.md. - Boundary markers: Explicit Zod schemas (e.g.,
UserSchema,PostSchema) define the expected structure of external data. - Capability inventory: Network access via fetch implementation.
- Sanitization: Uses Zod validation to ensure received payloads conform to expected types before processing.
- [CREDENTIALS_UNSAFE]: The documentation includes a placeholder for an authorization header (
Authorization: 'Bearer token'). This is a standard illustrative example and does not expose real credentials.
Audit Metadata