Borrowing it
Nothing to install: this file belongs to Aerozb/Postman-cn. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Aerozb/Postman-cn/main/.agents/skills/postman-zh-deep-audit/SKILL.mdgit clone --depth 1 https://github.com/Aerozb/Postman-cnWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit)<a href="https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit"><img src="https://agentmods.dev/badge/skills/aerozb/postman-cn/postman-zh-deep-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aerozb/postman-cn/postman-zh-deep-audit"><img src="https://agentmods.dev/badge/skills/aerozb/postman-cn/postman-zh-deep-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.00705 |
| Opus 5.5 | $0.00028 | $0.00282 |
| Sonnet 5.5 | $0.00014 | $0.00141 |
| Haiku 4.5 | $0.00007 | $0.00071 |
Grade A, and why
postman-zh-deep-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Postman 汉化维护
先读仓库根目录 AGENTS.md。唯一词典是 payload/zh-localize.js；命令和菜单收尾以 脚本说明 为准。
选择工作范围
- 截图反馈：定位对应界面，必要时定点读取真实 DOM 文本、属性和码位，先测已有
translate()，再按 AGENTS 的词典分类修复。不要凭截图猜原串或顺带遍历所有界面。 - 批量补译、版本升级：从当前官方 i18n 重新取材，见 i18n 说明。它提供原文，不直接替换官方语言包。
- 半译、隐形字符、源码补查：看 维护指南。仅当官方资源与反馈未覆盖时检查本地 asar / 缓存 bundle，不恢复固定扫描渠道。
- 自动更新或版本检查：先读 更新守卫，分清两个独立开关。
- 跨站 iframe：先读 跨站子帧汉化，区分 CDP 可读取与生产注入生效。
执行边界
固定操作通过根目录 postman-zh.bat 调用。需要 CDP 时复用公共客户端，连接前重新读取端口。报告和临时文件写同级 _generated；JSON 使用 scripts/lib/诊断输出.js 的 writeDiagnosticReport，摘要按最终结果计数。截图按需使用 writeDiagnosticScreenshot，PNG 像素未脱敏。
定点诊断跳过原生文件选择器和 data-postman-zh-audit-skip="true"。保留用户数据、代码、HTTP 字段和技术名称；避免发送、保存、删除用户数据或退出账号，结束前清理自有节点、弹窗和菜单。
自动巡检、缓存扫词、页面探测和漏翻收集已退役；历史漏翻数据保持原样。DOM 监听、延迟重试和跨帧注入是实际汉化路径，应继续保留。
验证
源码重构先运行 test；涉及注入或翻译行为时再 install、verify，重走对应界面。纯只读代码审查不要求安装或操纵页面；临时诊断的部分结果不作完整通过结论。
批量词条或翻译重构按维护指南比较真实 translate() 输出。发布按 升级与发布 执行，检查差异并排除临时产物与用户数据。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -33 lines · -21 tokens per session 292f0cee48fb
- 1mo ago Changed · -11 lines 4bd6b2fcf21f
- 2mo ago First seen · 75 lines · 92 tokens per session scan A 89f14caed3e7
postman-zh-deep-audit is a skill published in the GitHub repository Aerozb/Postman-cn (79 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 705 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pixiv-cli-mcp-tool
Add, change, or review a pixiv-cli Pixiv or FANBOX MCP tool, including schema, SDK routing, structured output, errors, stdio delivery and HTTP authorization boundaries. Use for MCP tool implementation or compatibility work, not routine installed-CLI operation.
i18n-validator
Validates multi-language consistency in the TRANSLATIONS dictionary of a plugin. Use to check if any language keys are missing or if translations need updating.
verify-language-switch
Prove a language switch translates what the user sees, keeps what they had already typed, and is still in force after a reload. Use when i18n, a locale picker, a language menu or translation files were added or changed, when a string is suspected of staying in the old language or showing a raw translation key, or when…
new-route
Scaffolds a new route with its page component, page story, and optional i18n keys. Use this skill whenever the user asks to "create a route", "add a new page", "scaffold /dashboard", "wire up a new route under public or session", or anything that implies adding a file under app/routes/ with a matching…
fec-component-testing
A guide for writing and reviewing front-end unit, component, and lightweight integration tests. These tests check small pieces of code and UI behavior without running a full browser journey.
igniteui-angular-testing
Quick-reference for running Ignite UI for Angular test suites. Covers the full library run (test:lib) on Vitest browser mode through the Angular unit-test builder, running a subset with --include/--filter, watch mode, extras/elements suites, and auxiliary suites (schematics, styles, i18n). WHEN TO USE: running…