The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration script scripts/agent.py invokes the newman CLI tool using subprocess.run(). The commands are constructed using a list of arguments, which is a secure practice that avoids shell injection vulnerabilities.
[DYNAMIC_EXECUTION]: The agent dynamically generates Postman collection files in JSON format. These files include JavaScript code blocks for test assertions, which are constructed from predefined templates and user-supplied parameters such as target URLs and authentication tokens.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves processing data returned from external APIs to validate security assertions. While this exposes a surface for processing untrusted data, the logic is constrained within the Postman sandbox environment, and the purpose is explicitly for security validation of those endpoints.

performing-api-security-testing-with-postman