postman-collection-generator
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill provides documentation and script templates rather than a standalone executable or automated tool. The provided TypeScript code serves as a reference for scanning route definitions and generating structured JSON outputs.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill correctly handles sensitive information by using environment variables (e.g.,
{{authToken}}) and placeholders in its templates. TheEnvironment Templatesection explicitly marks sensitive keys with"type": "secret", which is a recognized safe practice for managing API credentials. - [COMMAND_EXECUTION]: While the skill includes a CLI script (
postman-gen.ts), it uses standard argument parsing via thecommanderpackage and restricts its operations to file system reads (scanning routes) and writes (exporting the collection JSON). There are no patterns of arbitrary command execution or shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface as it processes untrusted codebase data to generate documentation. However, it lacks high-privilege capabilities (no network access or code execution) and uses structured JSON output, which inherently limits the impact of any instructions embedded in the scanned source code.
Audit Metadata