us-property-data
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs outbound HTTPS requests to the external domain
api.zillapi.com. It manages authentication by reading theZILLAPI_KEYenvironment variable and transmitting it as a bearer token in request headers. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for processing untrusted external data, specifically property identifiers provided by users.
- Ingestion points: Address strings, Zillow URLs, and property IDs (zpids) provided by the user and processed in
SKILL.md. - Boundary markers: The skill lacks technical delimiters (like XML tags) for input data, though it provides instructional guidance for the agent to verify estimates and handle missing data points.
- Capability inventory: The skill allows the agent to execute
GETandPOSTnetwork requests to theapi.zillapi.comdomain. - Sanitization: The instructions explicitly direct the agent to minimize data transmission by sending only required identifiers and avoiding the inclusion of personal data or credentials in parameters.
Audit Metadata