skills/grafana/skills/k6-docs/Gen Agent Trust Hub

k6-docs

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The documentation review workflow involves extracting and executing code snippets from documentation repositories. This design presents a surface for indirect prompt injection, as malicious code embedded in a repository file or pull request would be executed by the agent during the verification phase. The agent is instructed to find code blocks and run them locally to ensure documentation accuracy.
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install the agent-browser utility from the NPM registry. It also uses pnpm and npm to install workspace and project dependencies required for documentation testing and formatting.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code blocks extracted from markdown files. The workflow guides the agent to write these snippets to temporary files and execute them using go run . run in the k6 repository or via node, resulting in the execution of code derived from external repository content.
  • [COMMAND_EXECUTION]: The skill makes extensive use of shell commands and developer tools, including git, gh, go, npm, pnpm, and agent-browser, to manage repositories, run local test servers, and perform validation tasks. It also contains instructions to modify the user's environment by updating the PATH variable in shell configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 08:26 PM
Security Audit — agent-trust-hub — k6-docs