stress-testing
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file 'references/k6-stress-testing.md' contains hardcoded example credentials ('email': 'stress-test@example.com', 'password': 'test123') within a setup function. While these serve as placeholders for demonstration, hardcoding secrets in skill files is a discouraged practice.\n- [COMMAND_EXECUTION]: The skill includes a shell script 'scripts/scaffold-tests.sh' designed to generate test boilerplate. Scripts contained within a skill are executed in the agent's operating environment, which represents a potential attack vector if modified.\n- [INDIRECT_PROMPT_INJECTION]: This skill provides tools capable of generating high-volume network traffic, creating a surface for misuse where an agent could be manipulated via untrusted data to perform unauthorized Denial of Service (DoS) attacks.\n
- Ingestion points: Target URLs provided by users or extracted from external configuration documentation referenced in 'SKILL.md'.\n
- Boundary markers: None provided to prevent the agent from executing heavy load tests against sensitive or unauthorized infrastructure.\n
- Capability inventory: Extensive network request capabilities through multiple scripts using 'k6', 'requests', 'aiohttp', and 'axios'.\n
- Sanitization: No validation or sanitization logic is present to verify target URLs before execution.
Audit Metadata