get-flow-run
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the official
postmanCLI to fetch run status (postman flows get-run). This is a legitimate operation for the skill's stated purpose of inspecting execution logs. - [CREDENTIALS_UNSAFE]: The skill explicitly instructs to reuse existing
postman loginorPOSTMAN_API_KEYcredentials as defined inreferences/flows-cli-baseline.md. It does not store or request new secrets. - [EXTERNAL_DOWNLOADS]: The skill mentions installing the Postman CLI via
npm install -g postman-cli. This targets a well-known, official package registry for its primary tool. - [DATA_EXFILTRATION]: Uses a telemetry header
POSTMAN_CLI_SOURCE=claude-code-plugin. This is standard attribution for developer tools and does not involve exfiltration of sensitive user data. - [PROMPT_INJECTION]: The instructions are focused on functional CLI usage and reporting. There are no attempts to bypass safety filters or override agent behavior.
Audit Metadata