Zapier

Complete Zapier automation with Zaps, Tables, Interfaces, webhooks, REST Hooks API, and 6000+ app integrations.

Security Scan

The skill is an instruction-only Zapier reference that reasonably requests Zapier API credentials and a local config path for stored preferences; the pieces are internally consistent with minor documentation mismatches and an innocuous prompt-example pattern.

Purpose & Capability

Name/description (Zapier automation) matches the requested artifacts: ZAPIER_API_KEY for Zapier REST API and an optional Tables token for Tables API, plus a local config path for memory. No unrelated credentials or binaries are requested. Minor inconsistency: the SKILL metadata/registry lists ZAPIER_TABLES_TOKEN as required while the doc text describes it as optional for Tables API.

Instruction Scope

All runtime instructions are about Zapier operations: curl examples against api.zapier.com, how to create Zaps, Tables, Interfaces, triggers, webhooks, and storing user preferences in ~/zapier/memory.md. The skill persists a memory file under ~/zapier/ (documented). A prompt-injection detector flagged a 'system-prompt-override' pattern — this appears because the docs include an example 'System Prompt' for a Zapier chatbot in interfaces.md, not because the skill directly instructs the agent to change its own system prompt. Still, the presence of system-prompt examples means implementers should ensure the agent does not automatically adopt external system prompts.

Install Mechanism

Instruction-only skill with no install spec and no code files. This is low-risk: nothing is downloaded or written by an installer beyond the documented memory file that the skill itself may create/use.

Credentials

Requested environment variables (ZAPIER_API_KEY and ZAPIER_TABLES_TOKEN) are appropriate for a Zapier integration. The only minor mismatch is that the docs state the Tables token is optional while the registry metadata marks it required. The skill declares and uses only Zapier endpoints; no unrelated secrets are requested. The skill does persist preferences to ~/zapier/, so verify that sensitive keys are not written to disk inadvertently.

Persistence & Privilege

always:false and user-invocable:true (normal). The skill persists data under its own config path (~/zapier/), which is within scope. It does not request permanent platform-wide privileges or change other skills' configs.

Scan Findings in Context

[system-prompt-override] expected: The scanner found a system-prompt-like string. This appears in interfaces.md as an example 'System Prompt' for configuring Zapier chatbots (a benign documentation example). The skill does not otherwise instruct the platform to replace the agent's system prompt, but treat such examples cautiously to avoid accidental prompt overrides.

Assessment

This skill is a documentation/reference wrapper for Zapier and is internally coherent. Before installing: 1) Only provide ZAPIER_API_KEY / ZAPIER_TABLES_TOKEN if you trust Zapier and this skill — prefer tokens scoped to minimal permissions and create a separate integration token if possible. 2) Confirm whether ZAPIER_TABLES_TOKEN is actually required for your use (docs call it optional but metadata marks it required). 3) Check ~/zapier/memory.md after first run and do not store long-lived secrets there; keep API keys in secure environment variables or a secret manager. 4) Review any Zaps/webhooks the agent creates and their target URLs — this skill will send mapped data to Zapier and any connected apps you configure. 5) Be aware the docs include an example chatbot 'System Prompt' — ensure your agent runtime does not automatically adopt external system prompts. 6) Test with a limited/test Zapier account and non-production data first, and rotate/revoke tokens if you stop using the skill.

Complete Zapier reference. See auxiliary files for detailed operations.

Quick Start

# Test API connection
curl -H "Authorization: Bearer $ZAPIER_API_KEY" \
  https://api.zapier.com/v1/profile

Setup

On first use, read setup.md. Preferences stored in ~/zapier/memory.md.

When to Use

Any Zapier operation: create Zaps, manage Tables, build Interfaces, configure webhooks, integrate 6000+ apps, automate workflows.

Architecture

~/zapier/
├── memory.md      # Account context, common Zaps
└── zaps/          # Documented configurations

Quick Reference

Topic	File
Setup & memory	setup.md, memory-template.md
REST Hooks API	api.md
Triggers (all types)	triggers.md
Actions (all types)	actions.md
Filters, Paths, Formatters	logic.md
Webhooks (Catch Hook, send)	webhooks.md
Zapier Tables (database)	tables.md
Zapier Interfaces (forms)	interfaces.md
Popular integrations	integrations.md
Patterns & recipes	patterns.md

Core Rules

1. Test mode first — Use test data before enabling Zap
2. Triggers define scope — Zap only runs when trigger fires
3. Field mapping explicit — Always verify data flows correctly
4. Filters before actions — Reduce unnecessary task usage
5. Idempotency via dedup — Use Dedup filter for critical flows
6. Webhooks for instant — Polling triggers have 1-15 min delay

Authentication

Environment variables:

• ZAPIER_API_KEY — API key from zapier.com/developer/platform
• ZAPIER_TABLES_TOKEN — Tables API token (optional, for Tables API)

curl -H "Authorization: Bearer $ZAPIER_API_KEY" \
  https://api.zapier.com/v1/zaps

Zapier Product Suite

Product	Purpose	File
Zaps	Automated workflows	triggers.md, actions.md
Tables	No-code database	tables.md
Interfaces	Forms, pages, chatbots	interfaces.md
Chatbots	AI-powered assistants	interfaces.md
Canvas	Visual workflow planning	Web UI only

Common Traps

• Amount in wrong format → Zapier passes strings, convert with Formatter
• No idempotency → Dedup action prevents duplicate processing
• Webhook timeout → Return 200 within 30 seconds
• Task burn → One Zap run = 1+ tasks, filters don't count
• Polling delay → Free: 15min, Paid: 1-2min, Webhooks: instant

External Endpoints

Endpoint	Purpose
https://api.zapier.com/v1/*	REST Hooks API
https://hooks.zapier.com/hooks/catch/*	Incoming webhooks
https://tables.zapier.com/api/v1/*	Tables API
Connected apps	6000+ via Zapier

Security & Privacy

Environment variables used:

• ZAPIER_API_KEY — for REST Hooks API authentication

Sent to Zapier: Workflow data, field mappings, trigger/action configs Sent to connected apps: Only data you explicitly map Stays local: ~/zapier/ preferences, API keys (never logged) Never: Expose API keys, skip webhook verification

Trust

This skill sends data to Zapier (zapier.com) and any apps you connect through Zaps.

Related Skills

Install with clawhub install <slug> if user confirms:

• api — REST API patterns
• webhook — Webhook fundamentals
• saas — SaaS metrics and billing

Feedback

• If useful: clawhub star zapier
• Stay updated: clawhub sync