postman-openapi-converter
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill does not contain or request the execution of any shell commands or system-level operations.
- [EXTERNAL_DOWNLOADS]: No external code, scripts, or packages are downloaded or referenced for execution.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing the agent to map authentication schemes to Postman variables (e.g., {{token}}, {{api_key}}) and to leave placeholders empty in the generated environment file rather than hardcoding sensitive data.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of API specifications provided by the user. Ingestion points: OpenAPI 3.x or Swagger 2.0 specifications provided as text or file references. Boundary markers: None provided in the interpolation logic. Capability inventory: The skill only generates JSON text output and does not have access to tools for network communication, file writing, or command execution. Sanitization: No sanitization is performed on the input data, but the lack of dangerous capabilities mitigates the risk.
Audit Metadata