The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party content such as API specifications and Postman collections. This ingestion is mitigated by explicit ground rules instructing the agent to treat vendor content strictly as data and ignore any embedded instructions.
[COMMAND_EXECUTION]: The skill runs a local Python script (scripts/postman_inventory.py) to inventory API requests. This script is limited to the standard library, performs no network calls, and includes defensive logic to detect hardcoded credentials.
[DATA_EXFILTRATION]: The skill conducts network probes of third-party APIs but enforces strict redaction of credentials in logs and reports, preventing the accidental leakage of sensitive information.

api-audit