system-benchmark

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx artillery to run load tests. This command fetches the Artillery package from the npm registry, which is a standard and well-known service for Node.js package distribution.
  • [COMMAND_EXECUTION]: The skill generates and executes shell commands for benchmarking tools including k6, artillery, and ab (Apache Benchmark). These commands are necessary for the skill's primary purpose of measuring system performance.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external configuration and data files, which presents a surface for indirect prompt injection.
  • Ingestion points: Reads from an approved hosts configuration file and synthetic test data (e.g., users.csv) as described in the SKILL.md security section.
  • Boundary markers: The instructions mandate restricting tools to whitelisted domains and IPs, effectively limiting the scope of execution.
  • Capability inventory: Uses network-capable CLI tools (k6, artillery, ab) to perform stress and load testing.
  • Sanitization: Includes mandatory guardrails such as a downstream health-check loop and an automated kill switch to stop tests if error rates exceed 5%.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:44 PM