zap-fetch-typed-http

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the @zap-studio/fetch library, which is a resource owned by the vendor (zap-studio). It also uses zod for data validation, which is a well-known and trusted library for schema definition.
  • [PROMPT_INJECTION]: The skill describes an interface for ingesting data from external APIs via HTTP requests. This represents a surface for indirect prompt injection if the remote data contains instructions. However, the skill mitigates this by enforcing structured data validation via Zod schemas.
  • Ingestion points: Remote data fetched via $fetch and api.get/post methods defined in SKILL.md.
  • Boundary markers: Explicit Zod schemas (e.g., UserSchema, PostSchema) define the expected structure of external data.
  • Capability inventory: Network access via fetch implementation.
  • Sanitization: Uses Zod validation to ensure received payloads conform to expected types before processing.
  • [CREDENTIALS_UNSAFE]: The documentation includes a placeholder for an authorization header (Authorization: 'Bearer token'). This is a standard illustrative example and does not expose real credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 07:14 PM