The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts such as scripts/validate_setup.py and scripts/manage_collections.py to interact with the Postman API. It also utilizes the Newman CLI for running collection tests via subprocess execution. The agent is instructed to automatically run a diagnostic script upon the first use in a conversation.
[DATA_EXFILTRATION]: The skill is designed to communicate with the official Postman API (api.getpostman.com). It accesses sensitive credentials from a local .env file and incorporates multiple guardrails to prevent these secrets from being displayed in the chat interface or handled insecurely.
[PROMPT_INJECTION]: The skill includes behavioral directives and an automated setup instruction that modifies session initialization. It also presents an indirect prompt injection surface due to the processing of external Postman collections and API specifications. \n
Ingestion points: Data enters the agent context through the Postman API when listing collections or reading specifications in scripts like scripts/list_collections.py and scripts/postman_client.py. \n
Boundary markers: The skill documentation does not specify the use of delimiters or instructions for the agent to ignore embedded commands within the processed API data. \n
Capability inventory: The skill possesses capabilities for shell command execution (via Newman), network operations to the Postman API, and local file modifications (e.g., environment updates). \n
Sanitization: The skill implements an 'Auto-Secret Detection' feature in scripts/manage_environments.py to identify and protect sensitive variables like API keys and tokens.

postman-hardened