The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill demonstrates strong security awareness by explicitly warning against committing real tokens or API keys to version control. It provides guidance on using Postman's secret-typed variables and environment-specific current values to keep credentials out of exported JSON files.
[COMMAND_EXECUTION]: The documentation includes standard CLI usage for the newman tool to run collections headlessly in CI/CD pipelines, including how to pass environment variables safely.
[EXTERNAL_DOWNLOADS]: Mentions the use of the well-known newman package for executing tests. This is a standard tool in the Postman ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where API responses are parsed (e.g., pm.response.json()). It mitigates risks by recommending structural schema validation (pm.response.to.have.jsonSchema) over manual field checks, which reduces the likelihood of processing malicious payloads directly.

test-postman