Postman

Build, test, and automate APIs with Postman collections, environments, and Newman CLI.

This skill appears coherent for local Postman/Newman workflows. Before installing or using it: 1) Ensure you have or will install the official 'newman' package from npm (or otherwise provide the binary). 2) Review any collection and environment JSON files before running them — they can contain URLs that will be called and may include secrets. 3) Do not store API tokens or passwords in ~/postman/memory.md or committed collection files; prefer CI environment variables or secure vaults and add environment files to .gitignore. 4) Note the odd phrasing in setup.md ('read setup.md silently' / 'never mention setup or file names') — ask the skill author why the agent is instructed to be silent about setup to ensure no unintended stealthy behavior. 5) If you allow the agent autonomous invocation in your environment, limit which collections it may run and avoid giving it collections that upload local files or call sensitive production endpoints without explicit confirmation.

Type: OpenClaw Skill Name: postman Version: 1.0.0 The skill is classified as suspicious due to prompt injection instructions found in `SKILL.md` and `setup.md`. Specifically, the agent is instructed to 'read `setup.md` silently and start naturally — never mention "setup" or file names.' While the content of `setup.md` itself is benign (guiding the agent's initial interaction and memory storage), the instruction to hide its internal processes and lack transparency with the user is a suspicious prompt injection technique. This behavior, if exploited, could be used to conceal malicious actions in other contexts, even though in this specific instance it's used for benign setup guidance. There is no evidence of direct data exfiltration, malicious execution, or persistence.