Borrowing it
Nothing to install: this file belongs to Aerozb/Postman-cn. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Aerozb/Postman-cn/main/.agents/skills/postman-zh-deep-audit/SKILL.mdgit clone --depth 1 https://github.com/Aerozb/Postman-cnWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit)<a href="https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit"><img src="https://agentmods.dev/badge/skills/aerozb/postman-cn/postman-zh-deep-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit"><img src="https://agentmods.dev/badge/skills/aerozb/postman-cn/postman-zh-deep-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.01644 |
| Opus 5 | $0.00046 | $0.00822 |
| Sonnet 5 | $0.00018 | $0.00329 |
| Haiku 4.5 | $0.00009 | $0.00164 |
Grade A, and why
postman-zh-deep-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Postman 深度汉化审计
开始前
- 在项目根目录工作，并完整阅读
AGENTS.md。 - 确认权威汉化主体只有
payload/zh-localize.js，不要维护第二份 payload。 - 只通过根目录
postman-zh.bat调用安装、启动、验证和审计能力，不要绕过统一入口。菜单序号与命令的对应、审计名与各档位秒数上限见scripts/README.md（唯一副本）；probe和通用scan只是维护者 CLI 命令，不在普通用户菜单里。 - 将报告、截图和临时文件写入项目同级
_generated，不要放进项目根目录或scripts；输出路径只能使用该目录下的文件名。 - 默认输出保持简洁中文；只有显式使用
--details时才打印完整诊断，禁止向普通用户输出大段 JSON 或 Postman/Electron/npm 内部日志。 - 审计报告必须通过
scripts/audit/审计安全.js的writeAuditReport写入；不要把原始 CDP 目标、URL 参数、WebSocket 地址、请求/响应正文、输入值或令牌写入_generated。它返回写盘那份脱敏结果，摘要计数一律按返回值算（written.hits/written.summary），不要用本地的原始数组——脱敏会剔除身份噪声，用原始数组会报出报告里根本没有的条数。 - 截图默认关闭，只有一部分命令支持
--screenshot（名单见scripts/README.md），并必须通过writeAuditScreenshot写入；PNG 像素不会经过 JSON 脱敏，可能包含当前可见的工作区或请求内容。 - 无参数 TUI 使用
Read-Host接收主菜单和审计子菜单选择；每次选中并完成一项任务后应直接退出，禁止增加用于收尾的Read-Host、pause或其他按键等待。 - 通用审计不得点击文件、文件夹、上传、浏览或选择文件等会打开 Windows 原生文件选择器的入口。导入界面只用
audit import从 Postman 页面侧审计；不选择本机文件或目录，结束前清理脚本打开的弹窗和菜单。 - 跳过带
data-postman-zh-audit-skip="true"的元素（更新页那个自动更新开关就是这样标记的）。
漏翻修复流程
- 从截图、DOM、属性或审计报告中确认准确英文原文和具体界面路径。
- 先在
payload/zh-localize.js搜索现有词条和可能的半翻译变体。 - 按
AGENTS.md第 7 节的词典规则修改EXACT、PHRASES、RULES、EDITABLE_EXACT或MENU_ITEM_EXACT（页面内[role='menuitem']菜单项走这一个）；登录授权页面才修改payload/zh-auth-webview-preload.js；原生 Electron 菜单改scripts/internal/安装汉化.ps1里的包装器词典。 - 对含弯撇号、非断行空格或先前部分替换的文本补齐真实 DOM 变体。
- 运行
.\postman-zh.bat install，确认安装器和验证器均成功。 - 重走用户报告的界面路径，再运行最贴近该页面的定向审计。
- 最后运行轻量广扫，确认没有真实英文短语残留。
审计选择
- 快速巡检：
.\postman-zh.bat audit lightweight - 新建请求：
.\postman-zh.bat audit new-request - 新建集合：
.\postman-zh.bat audit new-collection - 导入界面：
.\postman-zh.bat audit import - 导航与设置：
.\postman-zh.bat audit navigation - 深层界面：
.\postman-zh.bat audit deep-areas - 易漏交互面：
.\postman-zh.bat audit targeted-surfaces - 入口弹窗：
.\postman-zh.bat audit entry-modals - 分阶段审计：
.\postman-zh.bat audit phased - 固定区域：
.\postman-zh.bat audit targeted - 全部调试目标：
.\postman-zh.bat audit all-targets
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · -11 lines 4bd6b2fcf21f
- 11d ago First seen · 75 lines · 92 tokens per session scan A 89f14caed3e7
postman-zh-deep-audit is a skill published in the GitHub repository Aerozb/Postman-cn (57 stars, last pushed 2d ago), licensed MIT. It adds 92 tokens to every session and 1,644 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
magpie-pr-management-quick-merge
Identify trivial, low-risk pull requests in the ready for maintainer review queue of that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the "express lane" a maintainer can review and merge in seconds. Surfaces and ranks candidates with per-PR diff summaries, an…
i18n-validator
Validates multi-language consistency in the TRANSLATIONS dictionary of a plugin. Use to check if any language keys are missing or if translations need updating.
pixiv-cli-mcp-tool
Add or change a pixiv-cli MCP tool with full sync of registration, tests, localized MCP docs, README, and CHANGELOG.
fec-component-testing
A guide for writing and reviewing front-end unit, component, and lightweight integration tests. These tests check small pieces of code and UI behavior without running a full browser journey.
cgs-content-audit
Use for content audit tasks that audit content coverage, duplication, tone consistency, localization needs, and production completeness; produce verification evidence, changed or proposed files, and handoff boundaries.
cgs-release-checklist
Use for release checklist tasks that check build, packaging, store, QA, localization, accessibility, rollback, and ship/no-ship readiness; produce verification evidence, changed or proposed files, and handoff boundaries.