The Agent Skills Directory

[COMMAND_EXECUTION]: The skill translates natural language instructions into Postman CLI flags (such as -i, -q, and --headers) without explicit guidance on escaping shell metacharacters, which could lead to command injection if malicious input is provided.\n- [PROMPT_INJECTION]: The skill processes untrusted JSON response bodies and headers from Postman Flow executions and displays them in the agent's context, creating an indirect prompt injection surface. 1. Ingestion points: SKILL.md (Step 3: "Response body"). 2. Boundary markers: Absent; the skill does not wrap processed data in protective delimiters. 3. Capability inventory: SKILL.md (Steps 3, 4, and 5: Shell execution of postman flows trigger, deploy, and update commands). 4. Sanitization: Absent; no filtering of response content is performed before presentation to the agent.\n- [CREDENTIALS_UNSAFE]: The skill interacts with authentication credentials via postman login and the POSTMAN_API_KEY environment variable, and it specifically mentions the --show-secrets flag to unmask tokens during dry runs.

trigger-flow