Ziptax Sales Tax

• Analyzed: May 12, 2026, 3:52 AM
• Findings: 1
• Version: 1.0.0
• Hash: cae999fc8af4c099dbc059b0a8943c39d5d70deb07cd48d2b0c0c9194e0def2a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to interact with the ZipTax API for sales tax lookups. All network requests are directed to the legitimate `api.zip-tax.com` domain. The `scripts/lookup.sh` script properly sanitizes user-provided address input using `python3 -c "import urllib.parse; print(urllib.parse.quote('$ADDRESS'))"` to prevent shell injection. The `ZIPTAX_API_KEY` is read from an environment variable and used as expected for API authentication, with no evidence of exfiltration to unauthorized destinations. No prompt injection attempts, obfuscation, or other malicious behaviors were found in `SKILL.md` or other files.