postman-hardened

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs the agent to run Python scripts (e.g., scripts/list_collections.py and scripts/postman_client.py) that call the Postman API (api.getpostman.com) to fetch user-generated collections, specs, documentation and monitor data—which the agent reads and uses to drive actions like generating collections, running tests, or creating mocks—thereby exposing it to untrusted third‑party content from Postman workspaces.