Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rodolfochicone/rc-project --skill rc-postmangit clone --depth 1 https://github.com/rodolfochicone/rc-projectWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rodolfochicone/rc-project/rc-postman)<a href="https://agentmods.dev/skills/rodolfochicone/rc-project/rc-postman"><img src="https://agentmods.dev/badge/skills/rodolfochicone/rc-project/rc-postman.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.01085 |
| Opus 5 | $0.00043 | $0.00543 |
| Sonnet 5 | $0.00017 | $0.00217 |
| Haiku 4.5 | $0.00009 | $0.00109 |
Grade A, and why
rc-postman scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Postman Collection
Keep a Postman collection synchronized with the API's real routes and request contracts. Build requests from what the code accepts, not from guesses. This skill is standalone and stack-agnostic; it detects how the project defines HTTP endpoints.
Required Inputs
- None. Operates on the current repository.
- Optional: the collection output directory (default
.techdocs/docs/postman/), the collection name (default derived from the project name), and which environments to emit (defaultLocal).
Workflow
-
Locate the collection. Search for an existing
*.postman_collection.json(.techdocs/docs/postman/,.techdocs/docs/,docs/). If found, read it to preserve its structure and reuse its directory; otherwise default the output to.techdocs/docs/postman/, creating the directory if needed. -
Discover HTTP endpoints from source. Detect the routing mechanism and enumerate every HTTP endpoint with its method, full path, and handler reference. Routing lives in different places per stack:
- Framework routers (Express, Fastify, NestJS, Gin, Echo, Spring controllers, FastAPI/Flask, Rails routes, ASP.NET controllers).
- Infrastructure manifests (
serverless.yml, API Gateway / OpenAPI definitions, k8s ingress) — usehttpevents; ignore non-HTTP triggers (queue, schedule, stream). - Exclude non-HTTP entry points (queue consumers, cron jobs, background workers).
-
Extract the request contract for each endpoint from its handler/validation layer:
- Path parameters — name, type, example.
- Query parameters — name, type, required/optional, default.
- Body — fields with type, required/optional, defaults, and constraints, read from the validation schema or DTO (Zod, Joi, Pydantic, class-validator, Go structs + tags, Java/C# DTOs).
- Headers — required headers (content type, auth, custom context headers).
- Capture a one-line purpose from the handler's doc comment or, failing that, its name.
-
Build or update the collection (Postman Collection Format v2.1.0):
- Schema:
https://schema.getpostman.com/json/collection/v2.1.0/collection.json. - Folders: group requests by resource or domain (one folder per resource/tag). Preserve any existing folder organization and non-HTTP helper folders the user maintains.
- Requests: for each endpoint set
method, the URL using{{baseUrl}}as host with the exact path, path variables in Postman:paramsyntax (with example values in the URLvariableblock), required headers, and — for body methods — a realistic example JSON body covering every schema field. Use type-appropriate example values (valid UUIDs for IDs, E.164 for phones, ISO 8601 for timestamps, enum members for enums,nullfor nullable fields). - Collection variables: keep
{{baseUrl}}and any existing variables; do not hardcode hosts. - Add new endpoints to the most appropriate folder; remove requests whose endpoints no longer exist in source and report them.
- Schema:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 59 lines · 86 tokens per session scan A 3bfa4dbcc31f
rc-postman is a skill published in the GitHub repository rodolfochicone/rc-project (19 stars, last pushed 1mo ago), licensed MIT. It adds 86 tokens to every session and 1,085 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
opensrc
Fetch dependency source code to give AI agents deeper implementation context. Use when the agent needs to understand how a library works internally, read source code for a package, fetch implementation details for a dependency, or explore how an npm/PyPI/crates.io package is built. Triggers include "fetch source for"…
multi-tenant-architecture
Designs tenant isolation, hostname routing, custom-domain lifecycle, and plan limits on Cloudflare or Vercel. Use when asked to "isolate tenant data", "support custom domains", "build a white-label platform", or assess PSL registration. For general module structure use codebase-architecture; for SEO content use…
background-script-execution
What actually happens when you call snowexecutescript — the Scripted REST endpoint Serac auto-deploys on first use, the scheduled-job fallback, what scheduledjobpending means, and how to get output back when the call comes home empty.
csdm-modeling
Pick the right ServiceNow service class under the Common Service Data Model — business service, service offering, application service, business application — and point the CMDB tools at it without creating the records CSDM tells customers to migrate away from.
inbound-email
Handle email arriving at a ServiceNow instance — inbound email action ordering and stop-processing, the real syseventinemailaction column names, and reading sysemail when a message created no record.
mcp-tool-discovery
Find and call tools on this ServiceNow MCP server — the two meta-tools it starts with, why a missing session id makes every other tool unreachable, which queries actually match, and which advertised tools are not on the server at all.