api-test-postman
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The README.md file includes installation instructions for Windows that utilize the '-ExecutionPolicy Bypass' flag. This is a common but potentially risky practice as it explicitly instructs the user to circumvent system-level security controls designed to prevent the execution of unsigned or untrusted scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection as it is designed to ingest and process untrusted external data (OpenAPI specifications, curl commands, and Postman collections in prompts/api-test-postman.md). The skill lacks explicit boundary markers or sanitization logic to prevent malicious instructions embedded within these external documents from influencing the agent's behavior. The skill possesses command execution capabilities through its provided testing scripts (scripts/run-tests.sh), increasing the potential impact of such an injection.
- [COMMAND_EXECUTION]: The script 'scripts/run-tests.sh' provides a direct entry point for executing the 'newman' CLI tool. While this is an intended feature for API testing, it introduces a command execution capability that processes user-supplied or environment-defined collection and environment files.
- [SAFE]: The skill demonstrates positive security posture by explicitly advising users in 'references/setup-and-ci.md' to keep sensitive credentials like tokens and API keys outside of committed files, recommending the use of environment variables and placeholders instead.
Audit Metadata