pmctl

Browse and inspect Postman collections, requests, and environments from the terminal using pmctl. Use when you need to discover API endpoints, look up reques...

This skill is documentation for using the pmctl CLI, not code bundled with your agent. Before using: (1) review the referenced GitHub repo and PyPI package to confirm authorship and review recent activity; (2) when adding a profile, supply a Postman API key only to accounts you trust and prefer a scoped or short‑lived key; (3) be cautious that `environments show --json` can reveal unmasked secrets — avoid piping those outputs to untrusted destinations; (4) consider using separate Postman profiles for sensitive vs. public work and rotate keys if needed.

Type: OpenClaw Skill Name: pmctl Version: 1.0.0 The skill bundle is suspicious because its documentation (`SKILL.md`) explicitly highlights that the `pmctl environments show --json` command returns "unmasked secrets." While this is presented as a feature "useful for scripting" and is inherent to the tool's purpose of inspecting Postman environments, it exposes a high-risk capability. An AI agent executing these instructions could be prompted to extract and potentially misuse sensitive environment variables (e.g., API keys, tokens) without further explicit malicious instructions within the skill bundle itself, making it a significant prompt injection risk for data exfiltration.