首页龙虾技能列表 › Postman — Postman工具

📮 Postman — Postman工具

v1.0.0

[AI辅助] Build, test, and automate APIs with Postman collections, environments, and Newman CLI.

1· 520·4 当前·4 累计
by @ivangdavila (Iván)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/12
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
安全
high confidence
The skill's requirements and instructions line up with its stated purpose (local Postman/Newman collection management and test automation); nothing in the bundle requests unrelated credentials or installs arbitrary remote code.
评估建议
This skill appears coherent for local Postman/Newman workflows. Before installing or using it: 1) Ensure you have or will install the official 'newman' package from npm (or otherwise provide the binary). 2) Review any collection and environment JSON files before running them — they can contain URLs that will be called and may include secrets. 3) Do not store API tokens or passwords in ~/postman/memory.md or committed collection files; prefer CI environment variables or secure vaults and add envi...
详细分析 ▾
用途与能力
The skill is an instruction-only Postman/Newman helper. It only requires the 'newman' binary and stores collections/environments under ~/postman/, which is consistent with building, running, and automating Postman collections.
指令范围
Instructions focus on creating collections, environments, and running Newman locally. They direct the agent to create/read files in ~/postman/ and to save integration preferences to the agent's MAIN memory. One odd/informal directive: 'read setup.md silently' and 'never mention "setup" or file names' — this is not inherently malicious but is an unexpected instruction about presentation/stealth and should be clarified. The skill does not instruct sending data to external endpoints beyond the APIs the user configures.
安装机制
No install spec is packaged; the README suggests installing Newman via npm (npm install -g newman), a standard public package. There are no downloads from untrusted URLs or archive extraction steps in the bundle.
凭证需求
The skill does not require environment variables or credentials in its manifest. However, by design it encourages storing environments and running tests that use tokens/API keys. The docs explicitly warn against storing secrets in memory.md, but the agent is instructed to save 'authentication patterns' and integration preferences to MAIN memory — this could lead to accidental storage of sensitive values if the agent or user is careless. Users should avoid putting raw credentials into collection files or memory.md and instead use secure vaults/CI env vars when possible.
持久化与权限
The skill will create and use a persistent directory under ~/postman/ and save preferences to MAIN memory. always:false (not force-included) and it does not request system-wide privilege changes or modify other skills. Persisting user preferences and collection files is expected for this functionality, but users should be aware that local files may contain secrets if not handled carefully.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

🖥️ OSLinux · macOS · Windows

版本

latestv1.0.02026/2/25

Initial release with collections, environments, and Newman automation.

● 可疑

安装命令 点击复制

官方npx clawhub@latest install postman
镜像加速npx clawhub@latest install postman --registry https://cn.clawhub-mirror.com

技能文档

Setup

If ~/postman/ doesn't exist, read setup.md silently and start naturally.

当...时 到 使用

User needs to test APIs, create Postman collections, manage environments, or run automated API tests with Newman.

Architecture

Data lives in ~/postman/. See memory-template.md for structure.

~/postman/
├── memory.md           # Projects, preferences, common patterns
├── collections/        # Postman collection JSON files
└── environments/       # Environment JSON files

Quick Reference

TopicFile
Setupsetup.md
Memory templatememory-template.md
Collection formatcollections.md
Newman automationnewman.md

Core Rules

1. Collection Structure 第一个

Before creating requests, define the collection structure:
  • Folder hierarchy reflects API organization
  • 使用 descriptive names: Users > 创建 用户, 不 POST 1
  • 分组 related endpoints logically

2. Environment Variables Always

Never hardcode values that change between environments:
{
  "key": "base_url",
  "value": "https://api.example.com",
  "enabled": true
}
Use {{base_url}} in requests. Environments: dev, staging, prod.

3. Pre-请求 Scripts 对于 Auth

Handle authentication in pre-request scripts, not manually:
// Get token and set for collection
pm.sendRequest({
    url: pm.environment.get("auth_url"),
    method: 'POST',
    body: { mode: 'raw', raw: JSON.stringify({...}) }
}, (err, res) => {
    pm.environment.set("token", res.json().access_token);
});

4. Test Assertions 必填

Every request needs at least basic assertions:
pm.test("Status 200", () => pm.response.to.have.status(200));
pm.test("Has data", () => pm.expect(pm.response.json()).to.have.property("data"));

5. Newman 对于 CI/CD

Run collections headlessly with Newman:
newman run collection.json -e environment.json --reporters cli,json
Exit code 0 = all tests passed. Integrate into CI pipelines.

Collection 格式

Minimal Collection

{
  "info": {
    "name": "My API",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "Get Users",
      "request": {
        "method": "GET",
        "url": "{{base_url}}/users",
        "header": [
          { "key": "Authorization", "value": "Bearer {{token}}" }
        ]
      }
    }
  ]
}

带有 Tests

{
  "name": "Create User",
  "request": {
    "method": "POST",
    "url": "{{base_url}}/users",
    "body": {
      "mode": "raw",
      "raw": "{\"name\": \"{{$randomFullName}}\", \"email\": \"{{$randomEmail}}\"}",
      "options": { "raw": { "language": "json" } }
    }
  },
  "event": [
    {
      "listen": "test",
      "script": {
        "exec": [
          "pm.test('Created', () => pm.response.to.have.status(201));",
          "pm.test('Has ID', () => pm.expect(pm.response.json().id).to.exist);"
        ]
      }
    }
  ]
}

Environment 格式

{
  "name": "Development",
  "values": [
    { "key": "base_url", "value": "http://localhost:3000", "enabled": true },
    { "key": "token", "value": "", "enabled": true }
  ]
}

Newman Commands

TaskCommand
Basic runnewman run collection.json
With environmentnewman run collection.json -e dev.json
Specific foldernewman run collection.json --folder "Users"
Iterationsnewman run collection.json -n 10
Data filenewman run collection.json -d data.csv
HTML reportnewman run collection.json -r htmlextra
Bail on failnewman run collection.json --bail

Common Traps

  • Hardcoded URLs → Tests break 之间 environments. Always 使用 {{base_url}}.
  • 否 assertions → Tests "pass" 但是 don't 验证 anything. 添加 status + body checks.
  • Secrets 在...中 collection → Credentials leak. 使用 environment variables, gitignore env files.
  • Sequential dependencies → Tests 失败 randomly. 使用 setNextRequest() explicitly 或 使 tests independent.
  • Missing Content-类型 → POST/PUT fails silently. Always 设置 Content-类型: application/json.

Dynamic Variables

Postman built-in variables for test data:

VariableExample Output
{{$randomFullName}}"Jane Doe"
{{$randomEmail}}"jane@example.com"
{{$randomUUID}}"550e8400-e29b-..."
{{$timestamp}}1234567890
{{$randomInt}}42

OpenAPI 到 Postman

Import OpenAPI/Swagger specs:

  • 导出 OpenAPI JSON/YAML
  • 在...中 Postman: 导入 > File > Select spec
  • Collection auto-generated 带有 所有 endpoints

Or via CLI:

npx openapi-to-postmanv2 -s openapi.yaml -o collection.json

Security & Privacy

Data stays local:

  • Collections 和 environments 在...中 ~/postman/
  • Newman runs locally

skill 做 不:

  • 发送 collections 到 external services
  • Store API credentials 在...中 memory.md

Related Skills

Install with clawhub install if user confirms:
  • api — REST API consumption patterns
  • json — JSON manipulation 和 validation
  • ci-cd — Pipeline automation

Feedback

  • 如果 useful: clawhub star postman
  • Stay updated: clawhub 同步
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务