qa-k6-writer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides patterns that reference external JavaScript libraries for data parsing and reporting.
- Mentions fetching a CSV parsing utility from
jslib.k6.io, which is the official repository for k6 extensions maintained by Grafana. - Mentions an HTML reporting utility hosted on GitHub (
benc-uk/k6-reporter). - [INDIRECT_PROMPT_INJECTION]: The skill processes performance plans and requirements provided as input to generate k6 test code, representing a standard vulnerability surface for indirect injection.
- Ingestion points: Reads performance test plans and non-functional requirement (NFR) specifications from other agent skills or user input as defined in the
SKILL.mdworkflow. - Boundary markers: None identified; the skill directly translates requirements into executable script logic.
- Capability inventory: The skill writes JavaScript (
.js) files to thetests/performancedirectory. - Sanitization: No explicit validation or escaping of input requirements is specified before code generation.
Audit Metadata