postman-openapi-converter
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided OpenAPI and Swagger specifications. These external data sources could potentially contain malicious instructions embedded within text fields like 'description' or 'summary'. However, the skill's instructions strictly map these fields into a static Postman Collection JSON schema, treating the input as data rather than instructions, which limits the risk to the agent.
- [NO_CODE]: The skill does not provide or execute any standalone scripts, binaries, or third-party code. It relies entirely on instructions for the AI agent to perform text-based transformation of data from one format to another.
- [SAFE]: The skill explicitly instructs the agent to handle authentication and sensitive data using Postman environment variables (e.g., {{api_key}}) instead of hardcoding values. This adheres to security best practices for API development tools.
Audit Metadata