Zapier
v1.0.0Complete Zapier automation with Zaps, Tables, Interfaces, webhooks, REST Hooks API, and 6000+ app integrations.
⭐ 1· 1.2k·17 current·18 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Zapier automation) matches the requested artifacts: ZAPIER_API_KEY for Zapier REST API and an optional Tables token for Tables API, plus a local config path for memory. No unrelated credentials or binaries are requested. Minor inconsistency: the SKILL metadata/registry lists ZAPIER_TABLES_TOKEN as required while the doc text describes it as optional for Tables API.
Instruction Scope
All runtime instructions are about Zapier operations: curl examples against api.zapier.com, how to create Zaps, Tables, Interfaces, triggers, webhooks, and storing user preferences in ~/zapier/memory.md. The skill persists a memory file under ~/zapier/ (documented). A prompt-injection detector flagged a 'system-prompt-override' pattern — this appears because the docs include an example 'System Prompt' for a Zapier chatbot in interfaces.md, not because the skill directly instructs the agent to change its own system prompt. Still, the presence of system-prompt examples means implementers should ensure the agent does not automatically adopt external system prompts.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low-risk: nothing is downloaded or written by an installer beyond the documented memory file that the skill itself may create/use.
Credentials
Requested environment variables (ZAPIER_API_KEY and ZAPIER_TABLES_TOKEN) are appropriate for a Zapier integration. The only minor mismatch is that the docs state the Tables token is optional while the registry metadata marks it required. The skill declares and uses only Zapier endpoints; no unrelated secrets are requested. The skill does persist preferences to ~/zapier/, so verify that sensitive keys are not written to disk inadvertently.
Persistence & Privilege
always:false and user-invocable:true (normal). The skill persists data under its own config path (~/zapier/), which is within scope. It does not request permanent platform-wide privileges or change other skills' configs.
Scan Findings in Context
[system-prompt-override] expected: The scanner found a system-prompt-like string. This appears in interfaces.md as an example 'System Prompt' for configuring Zapier chatbots (a benign documentation example). The skill does not otherwise instruct the platform to replace the agent's system prompt, but treat such examples cautiously to avoid accidental prompt overrides.
Assessment
This skill is a documentation/reference wrapper for Zapier and is internally coherent. Before installing: 1) Only provide ZAPIER_API_KEY / ZAPIER_TABLES_TOKEN if you trust Zapier and this skill — prefer tokens scoped to minimal permissions and create a separate integration token if possible. 2) Confirm whether ZAPIER_TABLES_TOKEN is actually required for your use (docs call it optional but metadata marks it required). 3) Check ~/zapier/memory.md after first run and do not store long-lived secrets there; keep API keys in secure environment variables or a secret manager. 4) Review any Zaps/webhooks the agent creates and their target URLs — this skill will send mapped data to Zapier and any connected apps you configure. 5) Be aware the docs include an example chatbot 'System Prompt' — ensure your agent runtime does not automatically adopt external system prompts. 6) Test with a limited/test Zapier account and non-production data first, and rotate/revoke tokens if you stop using the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97es9vbm4b08crcy4jjc6nvad81sc62
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚡ Clawdis
OSLinux · macOS · Windows
EnvZAPIER_API_KEY, ZAPIER_TABLES_TOKEN
Config~/zapier/
Primary envZAPIER_API_KEY