Install
$ agentstack add skill-rodolfochicone-rc-project-rc-postman ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Postman Collection
Keep a Postman collection synchronized with the API's real routes and request contracts. Build requests from what the code accepts, not from guesses. This skill is standalone and stack-agnostic; it detects how the project defines HTTP endpoints.
Required Inputs
- None. Operates on the current repository.
- Optional: the collection output directory (default
.techdocs/docs/postman/), the collection name (default derived from the project name), and which environments to emit (defaultLocal).
Workflow
- Locate the collection. Search for an existing
*.postman_collection.json(.techdocs/docs/postman/,.techdocs/docs/,docs/). If found, read it to preserve its structure and reuse its directory; otherwise default the output to.techdocs/docs/postman/, creating the directory if needed.
- Discover HTTP endpoints from source. Detect the routing mechanism and enumerate every HTTP endpoint with its method, full path, and handler reference. Routing lives in different places per stack:
- Framework routers (Express, Fastify, NestJS, Gin, Echo, Spring controllers, FastAPI/Flask, Rails routes, ASP.NET controllers).
- Infrastructure manifests (
serverless.yml, API Gateway / OpenAPI definitions, k8s ingress) — usehttpevents; ignore non-HTTP triggers (queue, schedule, stream). - Exclude non-HTTP entry points (queue consumers, cron jobs, background workers).
- Extract the request contract for each endpoint from its handler/validation layer:
- Path parameters — name, type, example.
- Query parameters — name, type, required/optional, default.
- Body — fields with type, required/optional, defaults, and constraints, read from the validation schema or DTO (Zod, Joi, Pydantic, class-validator, Go structs + tags, Java/C# DTOs).
- Headers — required headers (content type, auth, custom context headers).
- Capture a one-line purpose from the handler's doc comment or, failing that, its name.
- Build or update the collection (Postman Collection Format v2.1.0):
- Schema:
https://schema.getpostman.com/json/collection/v2.1.0/collection.json. - Folders: group requests by resource or domain (one folder per resource/tag). Preserve any existing folder organization and non-HTTP helper folders the user maintains.
- Requests: for each endpoint set
method, the URL using{{baseUrl}}as host with the exact path, path variables in Postman:paramsyntax (with example values in the URLvariableblock), required headers, and — for body methods — a realistic example JSON body covering every schema field. Use type-appropriate example values (valid UUIDs for IDs, E.164 for phones, ISO 8601 for timestamps, enum members for enums,nullfor nullable fields). - Collection variables: keep
{{baseUrl}}and any existing variables; do not hardcode hosts. - Add new endpoints to the most appropriate folder; remove requests whose endpoints no longer exist in source and report them.
- Emit environment files (one JSON per environment, separate from the collection) under the output directory:
- Use the standard environment schema (
_postman_variable_scope: "environment") with avaluesarray of{key, value, type, enabled}. - Local:
baseUrlpointing at the local dev server; placeholder IDs. - Additional environments (e.g. Staging) only when requested or already present: include their
baseUrlplus any requiredAuthorization/context-header variables, referenced from requests via{{var}}so values never live in the collection.
- Validate and save. Ensure the collection and every environment file are valid JSON conforming to v2.1.0. Save the collection and environment files to the output directory.
- Report the diff: endpoints added, updated, removed (no longer in source), and unchanged.
Critical Rules
- Build requests only from real endpoints and real schemas — never invent endpoints, fields, or routes.
- Stay on Postman Collection Format v2.1.0; keep the
schemaURL intact. - Never hardcode hostnames or secrets in the collection; parameterize via
{{baseUrl}}and environment variables. - Preserve existing collection variables, folder structure, and user-maintained helper folders; do a surgical sync, not a blind overwrite — except sections the skill explicitly regenerates.
- Example values must be coherent with each field's real type and constraints.
- Do not modify any source code. This skill only writes the collection and environment files.
Error Handling
- If no HTTP endpoints can be discovered, report the routing mechanisms inspected and ask the user to point at the route definitions.
- If a handler's request schema cannot be located, emit the request with the parameters you could determine and flag the body as incomplete rather than fabricating fields.
- If an existing collection file is malformed JSON, stop and report it before overwriting.
- If files cannot be written to the output directory, stop and report the filesystem error.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rodolfochicone
- Source: rodolfochicone/rc-project
- License: MIT
- Homepage: https://rodolfochicone.dev
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.