system-benchmark
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx artilleryto run load tests. This command fetches the Artillery package from the npm registry, which is a standard and well-known service for Node.js package distribution. - [COMMAND_EXECUTION]: The skill generates and executes shell commands for benchmarking tools including
k6,artillery, andab(Apache Benchmark). These commands are necessary for the skill's primary purpose of measuring system performance. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external configuration and data files, which presents a surface for indirect prompt injection.
- Ingestion points: Reads from an approved
hostsconfiguration file and synthetic test data (e.g.,users.csv) as described in theSKILL.mdsecurity section. - Boundary markers: The instructions mandate restricting tools to whitelisted domains and IPs, effectively limiting the scope of execution.
- Capability inventory: Uses network-capable CLI tools (
k6,artillery,ab) to perform stress and load testing. - Sanitization: Includes mandatory guardrails such as a downstream health-check loop and an automated kill switch to stop tests if error rates exceed 5%.
Audit Metadata