Loading...
Loading...
Found 12 Skills
Full API lifecycle management through Postman. Sync OpenAPI specs to collections, generate typed client code, run API tests, create mock servers, publish documentation, audit security against OWASP Top 10, and discover APIs across workspaces. Requires the Postman MCP Server. Use this skill when the user mentions Postman, API collections, syncing specs, generating SDKs, running API tests, creating mocks, API documentation, or API security audits. Triggers on tasks involving API development workflows, collection management, or any Postman-related operations.
Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, automated API testing, or OWASP API testing with Postman.
Generates Postman collection JSON files from Express, Next.js, Fastify, Hono, or other API routes. Scans route definitions, extracts endpoints, methods, params, and creates importable collections. Use when users request "generate postman collection", "export to postman", "create postman file", or "postman import".
Tool-based API testing with Postman and Bruno - collections, environments, test assertions, CI integration. Use when: postman, bruno, API testing, test API endpoint, API collection, HTTP request testing, endpoint validation.
The CLI for the public API directory at postman.com/explore — search, rank, and watch community-contributed Postman Collections, agent-native and offline. Trigger phrases: `find a postman collection for`, `what postman collection should i fork for`, `is there a postman collection for`, `browse postman api network`, `compare postman publishers`, `what changed on the postman network`, `use postman-explore`, `run postman-explore`.
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
Generates OpenAPI 3.0/3.1 specifications from Express, Next.js, Fastify, Hono, or NestJS routes. Creates complete specs with schemas, examples, and documentation that can be imported into Postman, Insomnia, or used with Swagger UI. Use when users request "generate openapi", "create swagger spec", "openapi documentation", or "api specification".
Use this skill when testing REST or GraphQL APIs, implementing contract tests, setting up mock servers, or validating API behavior. Triggers on API testing, Postman, contract testing, Pact, mock servers, MSW, HTTP assertions, response validation, and any task requiring API test automation.
A long-tail product collection skill covering low-frequency DingTalk products: OA approval query and handling / legal smart contract / attendance / live / DING urgent messages / Open Platform apps and MCP development / Agoal goal management / log daily-weekly reports / spreadsheet / Open Platform doc search and OpenAPI escape hatch / standalone and doc-embedded whiteboard / DingTalk recruiting / DWS skill marketplace installation / Organization Brain Hrbrain / native Markdown / native HTML / PAT behavior authorization / multi-organization profile. Use when the user mentions any of the above products, especially Agoal/goal management/strategy decoding/business contracts and field configuration/scorecard/OKR/goal rules and periods/personal goals/goal templates/weekly-monthly report rule submission statistics/on-time/late/missing/follow-up, or querying/creating contract ledgers, batch importing contracts, drafting contracts from transcripts, archiving contracts, managing contract projects/counterparties/payments, or checking pending approvals/approve-reject-transfer-revoke approvals/clock-in/scheduling/daily-weekly report content filling/standalone whiteboard creation with content/whiteboard node read-write/cell read-write/recruiting positions/JD/creating positions/searching and installing skills/developer console apps/enterprise internal apps/checking app status or deletability/app member and role summary/app version history/enterprise internal app robot configuration, message mode, or online status/local robot connector/Stream connection/MCP services or tools/publishing or debugging MCP/fetching or invoking published MCP/turning OpenAPI, Swagger, Postman, curl, or HTTP interfaces into MCP or for Agent use/unwrapped OpenAPI/llms.txt/dws api/talent pool/employee profile/career history/performance/native .md files/Markdown version comparison/local draft diff/Markdown comments/native .html files/creating HTML pages/PAT authorization/switching organization/cross-organization/profile, and other related operations. Weekly/monthly report content filling belongs to report; rule-level on-time, late, missing statistics and personnel follow-up belong to Agoal; submitting daily/weekly/briefing reports with approvers, CC recipients, or approval flows belongs to OA approval. Real-time listening for future approval tasks or instance changes is not part of this skill; use dingtalk-event. After a match, the skill's Product Index Table locates the specific sub-product and command prefix, then executes according to that sub-product's instructions.
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
Design API test plans and cases for REST/GraphQL/gRPC interfaces. Default output Markdown; can request Excel, CSV, or JSON. Use for API testing.
Design API testing plans and test cases covering REST/GraphQL/gRPC interfaces. Default output is Markdown, and Excel/CSV/JSON output can be requested. Use for API testing or api-testing.