k6-docs
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The documentation review workflow involves extracting and executing code snippets from documentation repositories. This design presents a surface for indirect prompt injection, as malicious code embedded in a repository file or pull request would be executed by the agent during the verification phase. The agent is instructed to find code blocks and run them locally to ensure documentation accuracy.
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install the
agent-browserutility from the NPM registry. It also usespnpmandnpmto install workspace and project dependencies required for documentation testing and formatting. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code blocks extracted from markdown files. The workflow guides the agent to write these snippets to temporary files and execute them using
go run . runin the k6 repository or vianode, resulting in the execution of code derived from external repository content. - [COMMAND_EXECUTION]: The skill makes extensive use of shell commands and developer tools, including
git,gh,go,npm,pnpm, andagent-browser, to manage repositories, run local test servers, and perform validation tasks. It also contains instructions to modify the user's environment by updating thePATHvariable in shell configuration files.
Audit Metadata