Native Typeform

• Risk level: Low
• Analyzed: Feb 24, 2026, 10:14 AM
• Findings: 0
• Version: 1.0.1

Overview

The skill is internally consistent with its stated purpose: it only needs a Typeform read token and python3, calls api.typeform.com directly, and the included script performs the described read-only operations.

This skill appears to do exactly what it says: it runs a small Python script that calls api.typeform.com using the TYPEFORM_TOKEN you provide. Before installing, be aware that the token grants read access to your forms, responses, and insights — responses may contain sensitive user data. Use a token with the minimum scopes needed, store it securely (avoid exposing it in shared environments), and rotate/revoke the token when you no longer need the skill. If you want extra assurance, review the included scripts/typeform.py (it uses only the Python standard library and only sends requests to api.typeform.com). Finally, note that the agent can invoke the skill autonomously by default; if you want tighter control, restrict when the skill may be used or avoid enabling autonomous behaviors in your agent configuration.