Menu
When the user asks to fetch a webpage, hit a REST API, or POST JSON to an endpoint, use the http.get / http.post tools — never invent URLs.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
When a task can't be done with the other curated tools (file.read, http.get, tasks.create, mail.list, etc.), use bash — runs any shell command on the agent host through the DDISA grant cycle.
When the user asks you to read, write, or check a file in your home directory, use the file.read / file.write tools — they're $HOME-jailed and safer than bash cat.
When the user asks about their inbox — what's there, search for an email, recent unread — use mail.list / mail.search.
When the user wants to see, create, or schedule a task/reminder/wiedervorlage on their personal task list, use tasks.list / tasks.create.
When the user asks for the current time, date, or wants a sanity-check that the runtime is alive, use the time.now tool — never guess.
OpenAPE Shapes — grant-aware CLI wrappers with adapter registry for structured, auditable command execution
| name | http |
| description | When the user asks to fetch a webpage, hit a REST API, or POST JSON to an endpoint, use the http.get / http.post tools — never invent URLs. |
| metadata | {"openape":{"requires_tools":["http.get"]}} |
http.get — read content from any HTTPS URL (webpages, REST endpoints, JSON APIs)http.post — POST JSON to an HTTPS URLBoth are bounded:
Authorization for arbitrary hosts, no Cookie)For commands that go beyond simple HTTP (auth, mTLS, complex curl flags, multipart upload), use the bash tool with curl instead.
Fetch JSON:
http.get({
"url": "https://api.example.com/users/42",
"headers": { "Accept": "application/json" }
})
POST JSON:
http.post({
"url": "https://api.example.com/notes",
"body": { "title": "from agent", "body": "..." },
"headers": { "Content-Type": "application/json" }
})
http.get only after you've seen it in their message or in a tool result.Authorization: Bearer …, the deny-list strips it. Use bash with curl if you need it.