postman-collection-generator
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard utility for data transformation. It takes natural language API descriptions or cURL commands and formats them into Postman-compatible JSON. It does not invoke any external tools, perform network requests, or interact with the local filesystem, making the risk of exploitation minimal.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted user input (API descriptions and cURL commands), it lacks exploitable capabilities (such as file writing or network access) that would allow an injection to cause harm. The instructions specifically guide the agent to parse fields into a rigid JSON schema, which further limits the impact of potentially malicious input strings.
- Ingestion points: User-provided API descriptions and cURL commands parsed in Step 1 to extract names, methods, headers, and payloads.
- Boundary markers: None explicitly defined, though the specific JSON schema requirement for v2.1.0 acts as a structural constraint.
- Capability inventory: No tools or privileged operations are defined in the frontmatter or used in the instructions; the skill is limited to generating text output.
- Sanitization: The skill relies on field-specific parsing of cURL flags (e.g., -H for headers, -d for body) to sanitize and structure the user input.
Audit Metadata