postman-newman-automation
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data sources which could potentially contain malicious instructions.
- Ingestion points: Collection source URLs, environment files, and iteration data (CSV/JSON) are processed by the generated Newman commands.
- Boundary markers: There are no explicit instructions or delimiters in the generated scripts to prevent the execution of malicious scripts if embedded within a Postman collection.
- Capability inventory: The generated scripts include shell command execution (via Jenkins and local shell) and network requests (via the Newman CLI).
- Sanitization: The skill logic does not provide automated validation or sanitization of the provided URLs or file content.
- [COMMAND_EXECUTION]: The skill generates shell scripts and Jenkinsfiles that execute CLI commands (
newman,npm) to automate testing workflows. - [EXTERNAL_DOWNLOADS]: The skill instructions and generated scripts reference the installation of official packages (
newman,newman-reporter-htmlextra) from the npm registry, which is a well-known service for this toolset.
Audit Metadata