Ziptax Sales Tax

Look up U.S. sales tax rates using the ZipTax API. Use when the user asks about sales tax rates, tax calculations for a U.S. address/ZIP code/coordinates, freight or service taxability, jurisdiction-level tax breakdowns, use tax vs sales tax, or needs to integrate sales tax data into an application. Also handles account usage metrics and product taxability codes (TIC). Supports address-level (door-level), lat/lng, and postal code lookups across 12,000+ jurisdictions.

Security Scan

The skill appears to implement a legitimate ZipTax lookup, but registry metadata omits required environment variables and required binaries that the bundled script and SKILL.md clearly need — this mismatch is an incoherence you should resolve before installing.

Purpose & Capability

The name, description, SKILL.md, bundled script, and API reference all consistently implement a ZipTax sales-tax lookup API client — that capability matches the stated purpose. However, the registry metadata fails to declare the credential and runtime tools the skill actually needs (see environment_proportionality and install_mechanism).

Instruction Scope

SKILL.md and the script stay within the scope of looking up tax rates and account metrics against api.zip-tax.com. There are no instructions to read unrelated system files, search shell history, or transmit data to unexpected endpoints. Network calls are limited to the documented ZipTax endpoints.

Install Mechanism

There is no install spec (instruction-only style) and nothing is downloaded or extracted. The risk is therefore low from install-time actions. Note: a shell script is bundled and will perform network calls when run.

Credentials

Both SKILL.md and scripts/lookup.sh require an API key (ZIPTAX_API_KEY) and the script uses curl and python3, but the registry metadata lists no required environment variables, no primary credential, and no required binaries. That mismatch is a meaningful incoherence — the skill will fail or prompt for credentials at runtime, and the registry did not declare that secret access is needed.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system configs, and is user-invocable only. It does not request elevated or persistent platform privileges.

What to consider before installing

Before installing: (1) Verify the source and owner — the skill has no homepage and the source is unknown. (2) Expect to provide an API key (ZIPTAX_API_KEY); the SKILL.md and scripts require it but the registry metadata does not declare it — confirm whether the platform will store or transmit that key. (3) The bundled script calls api.zip-tax.com via curl and requires python3; ensure those binaries are present and acceptable. (4) If you want to use this skill, ask the publisher to update the registry metadata to declare ZIPTAX_API_KEY as a required credential and list required binaries (curl, python3). (5) If you are concerned about secrets, create a dedicated ZipTax key with limited quota and monitor usage after enabling the skill.

ZipTax Sales Tax Lookup

Setup

Set ZIPTAX_API_KEY env variable with your API key from https://platform.zip.tax (DEVELOP > API Keys). Free tier gives 100 calls/month. Never share your API key publicly.

Quick Start

Address Lookup (most accurate)

curl -s "https://api.zip-tax.com/request/v60?address=200+Spectrum+Center+Drive+Irvine+CA+92618" \
  -H "X-API-KEY: $ZIPTAX_API_KEY"

Postal Code Lookup

curl -s "https://api.zip-tax.com/request/v60?postalcode=92618" \
  -H "X-API-KEY: $ZIPTAX_API_KEY"

Lat/Lng Lookup

curl -s "https://api.zip-tax.com/request/v60?lat=33.6525&lng=-117.7479" \
  -H "X-API-KEY: $ZIPTAX_API_KEY"

Workflow

1. Determine lookup type: address (best), lat/lng, or postal code
2. Use v60 (latest) for full jurisdiction breakdowns; use v10 for simple combined rate
3. Make GET request to https://api.zip-tax.com/request/v60 with auth header
4. Check metadata.response.code — 100 means success
5. Read taxSummaries[0].rate for total sales tax rate
6. Read baseRates array for state/county/city/district breakdown
7. Check service.taxable and shipping.taxable for service/freight taxability

Key Points

• Address > Postal code: Address gives one exact result; postal code returns all rates in that ZIP
• Auth: Header X-API-KEY or query param key
• Rate format: Decimal (0.0775 = 7.75%)
• Response code 100 = success; check metadata.response.code
• Metrics endpoint (/account/metrics) does not count against quota

Bundled Resources

• scripts/lookup.sh — CLI wrapper for quick lookups. Run with --address, --lat/--lng, --postalcode, or --metrics
• references/api-reference.md — Full API reference with all endpoints, response schemas, code samples, response codes, and SDK links. Read when you need endpoint details or response field definitions.