pp-postman-explore

SUSPICIOUS: the skill’s purpose mostly matches its capabilities, but it depends on a non-official third-party CLI from a personal publisher and uses unpinned install paths. Data flows are mostly coherent for public Postman discovery, yet optional webhook/feedback delivery expands exfiltration surface. Main concern is supply-chain trust, not confirmed malicious behavior.