performance-test

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references documentation and installation resources from well-known and trusted organizations including Apache, Google, Docker, and Grafana (k6). These references are used to guide the user and agent in setting up standard performance testing environments.
  • [COMMAND_EXECUTION]: The skill is designed to manage the installation of performance testing tools and the execution of test suites. It includes strict governance rules, explicitly stating that authoring or initialization does not authorize execution, and requires a separate user-initiated command flag (--mode=verify) to run tests.
  • [DYNAMIC_EXECUTION]: The skill generates and executes project-specific scripts for load generation and resource monitoring. This behavior is central to its intended purpose and is governed by clear boundaries that prevent unauthorized or silent execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes project artifacts like manifests, CI scripts, and source code. While this creates a surface for indirect prompt injection from codebase content, the skill defines clear protocols and quality gates to maintain focus on performance metrics and prevent accidental obedience to embedded instructions.
  • Ingestion points: Project manifests, scripts, CI files, and existing test code (identified in SKILL.md discovery steps).
  • Boundary markers: Uses "MUST READ" and "MUST ATTENTION" headers, and references specific protocol guides to maintain operational constraints.
  • Capability inventory: Utilizes subagent spawning and shell command execution for discovery and testing.
  • Sanitization: Relies on strict mode dispatching and specific CLI flags to gate dangerous operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 01:34 AM