Menu
When the user asks to fetch a webpage, hit a REST API, or POST JSON to an endpoint, use the http.get / http.post tools — never invent URLs.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
When a task can't be done with the other curated tools (file.read, http.get, tasks.create, mail.list, etc.), use bash — runs any shell command on the agent host through the DDISA grant cycle.
When the user asks you to read, write, or check a file in your home directory, use the file.read / file.write tools — they're $HOME-jailed and safer than bash cat.
When the user asks about their inbox — what's there, search for an email, recent unread — use mail.list / mail.search.
When the user wants to see, create, or schedule a task/reminder/wiedervorlage on their personal task list, use tasks.list / tasks.create.
When the user asks for the current time, date, or wants a sanity-check that the runtime is alive, use the time.now tool — never guess.
OpenAPE Shapes — grant-aware CLI wrappers with adapter registry for structured, auditable command execution
| name | http |
| description | When the user asks to fetch a webpage, hit a REST API, or POST JSON to an endpoint, use the http.get / http.post tools — never invent URLs. |
| metadata | {"openape":{"requires_tools":["http.get"]}} |
http.get — read content from any HTTPS URL (webpages, REST endpoints, JSON APIs)http.post — POST JSON to an HTTPS URLBoth are bounded:
Authorization for arbitrary hosts, no Cookie)For commands that go beyond simple HTTP (auth, mTLS, complex curl flags, multipart upload), use the bash tool with curl instead.
Fetch JSON:
http.get({
"url": "https://api.example.com/users/42",
"headers": { "Accept": "application/json" }
})
POST JSON:
http.post({
"url": "https://api.example.com/notes",
"body": { "title": "from agent", "body": "..." },
"headers": { "Content-Type": "application/json" }
})
http.get only after you've seen it in their message or in a tool result.Authorization: Bearer …, the deny-list strips it. Use bash with curl if you need it.