pmctl

• Analyzed: May 12, 2026, 4:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2e20293e209c11df68e292f331fa902248b4b2bc842ddd7b99c23d0de8d35132
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is suspicious because its documentation (`SKILL.md`) explicitly highlights that the `pmctl environments show --json` command returns "unmasked secrets." While this is presented as a feature "useful for scripting" and is inherent to the tool's purpose of inspecting Postman environments, it exposes a high-risk capability. An AI agent executing these instructions could be prompted to extract and potentially misuse sensitive environment variables (e.g., API keys, tokens) without further explicit malicious instructions within the skill bundle itself, making it a significant prompt injection risk for data exfiltration.