list-flows

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the postman flows list command to retrieve information from the Postman platform, which is the primary intended functionality.
  • [EXTERNAL_DOWNLOADS]: The skill references the postman-cli package from the official NPM registry, a well-known and recognized service for the skill's domain.
  • [PROMPT_INJECTION]: The skill processes flow names which are external metadata. Ingestion points: Flow names and IDs from the Postman CLI output in SKILL.md. Boundary markers: Absent. Capability inventory: Read-only CLI execution using the postman command in SKILL.md. Sanitization: Absent. This finding is considered safe as the data ingested is limited to workspace metadata and the skill's capabilities are restricted to read-only operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 05:24 AM
Security Audit — agent-trust-hub — list-flows