testland/postman-collections
Authors Postman collections (requests + tests + variables + environments), runs them headless via the Newman CLI, configures reporters (cli / json / junit / html) for CI artifact upload, and uses iteration data files (JSON / CSV) for data-driven runs. Use when the project ships HTTP API tests authored in Postman and the team needs CI execution alongside or instead of the Postman desktop runner.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required runtime path is `newman run <collection-file-source>`, where that collection source may be a user-provided Postman Cloud/public-link URL or URL exported from Postman, meaning outsider-authored JSON/strings from that externally authored collection can be ingested at runtime (e.g., tests under `pm.test` and request/response processing).
Where we found it
api.getpostman.com
domain · 1 site
The plugin documents that `newman run` can fetch a collection from api.getpostman.com, meaning externally-authored JSON (including executable pm.test scripts) is ingested at runtime.
SKILL.md
67
A Postman Cloud URL: `https://api.getpostman.com/collections/...`.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill explicitly allows "newman run" to fetch a Postman Cloud collection at runtime from https://api.getpostman.com/collections/... and the retrieved collection JSON can contain Postman test scripts that Newman will execute, so remote content can directly control runtime execution.
Where we found it
newman
dependency · 2 sites
The plugin instructs installing newman from npm at runtime; the fetched package executes collection JSON including embedded test scripts, so remote content can control runtime execution.
SKILL.md
39
npm install -g newman
SKILL.md
47
npm install --save-dev newman
newman-reporter-htmlextra
dependency · 1 site
The plugin instructs installing newman-reporter-htmlextra from npm at runtime as an external reporter dependency.
SKILL.md
53
npm install --save-dev newman-reporter-htmlextra
dorny/test-reporter@v1
dependency · 1 site
The CI workflow template invokes a third-party GitHub Action (dorny/test-reporter@v1) at runtime, which is fetched from GitHub and executed in the CI pipeline.
references/newman-reference.md
69
uses: dorny/test-reporter@v1
actions/checkout@v5
dependency · 1 site
The CI workflow template invokes actions/checkout@v5, a GitHub-hosted action fetched at runtime.
references/newman-reference.md
36
- uses: actions/checkout@v5
actions/setup-node@v4
dependency · 1 site
The CI workflow template invokes actions/setup-node@v4, a GitHub-hosted action fetched at runtime.
references/newman-reference.md
38
- uses: actions/setup-node@v4
actions/upload-artifact@v4
dependency · 1 site
The CI workflow template invokes actions/upload-artifact@v4, a GitHub-hosted action fetched at runtime.
references/newman-reference.md
59
uses: actions/upload-artifact@v4
- Audited
- Security analysis