postman
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
newmanpackage via the Node Package Manager (NPM). This is a well-known, industry-standard tool for running Postman collections headlessly. - [COMMAND_EXECUTION]: The skill provides examples of shell commands to execute Newman collection runs, including parameters for environment files and report generation in CI/CD pipelines.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates processing external API response data using
pm.response.json(). This establishes a data ingestion surface where external content (API responses) enters the agent's context. However, the skill provides specific validation assertions and follows best practices for handling this data, minimizing the risk of schema confusion or downstream exploitation.
Audit Metadata