The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes local CLI tools including gcx, k6, curl, jq, tar, shasum, and sed. These tools are used to orchestrate cloud test operations, process API responses, and manage local test script files.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to official vendor domains (api.k6.io, cloudlogs.k6.io) to retrieve test configurations, telemetry, and log data. It also facilitates the download of test artifacts like browser screenshots using pre-signed S3 URLs generated by the vendor's API.
[CREDENTIALS_UNSAFE]: The skill handles sensitive authentication material by prompting the user for a k6 API token and a Stack ID. These credentials are used to populate the Authorization and X-Stack-ID headers for API requests. This is the documented and necessary method for interacting with the k6 Cloud API.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes external data such as Loki logs, Tempo traces, and cloud-hosted test scripts.
Ingestion points: Data is retrieved from external API endpoints via gcx api and curl as described in sections 4, 7, and 8 of SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or specific security headers to isolate external data from the agent's internal instructions.
Capability inventory: The skill has significant capabilities, including executing shell commands, writing to the local filesystem, and running k6 scripts via the local CLI.
Sanitization: There is no mention of sanitizing or escaping the content of logs or traces before they are summarized by the agent.

k6-manage