k6-perf-test-website
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads standard performance testing dependencies including
har-to-k6andplaywrightvia npm, and Chromium via the Playwright CLI. These are required for the tool's primary purpose and are fetched from official package registries. - [REMOTE_CODE_EXECUTION]: Test scripts import utility and assertion libraries from
jslib.k6.io, which is the official community repository for k6 extensions. These imports are standard practice for k6 users. - [COMMAND_EXECUTION]: The skill includes shell scripts (
lg-monitor.sh,run-with-monitor.sh) to monitor system resources (CPU, Memory, Network) during load tests. These scripts use standard system utilities liketop,ps, andnetstatto provide visibility into load generator health, ensuring testing accuracy. - [CREDENTIALS_UNSAFE]: While the workflow requires credentials for authenticated testing, the skill provides extensive documentation on safe handling. It specifically instructs users to use environment variables (
__ENV) and dedicated test accounts, and warns against committing sensitive data or recorded session tokens found in HAR captures. - [INDIRECT_PROMPT_INJECTION]: The skill processes network traffic captures (HAR files) to generate test code. While HAR files contain data from external websites, the skill enforces a manual 'hand-cleaning' step where developers audit the generated code before it is used in load testing scenarios, mitigating risks from untrusted external content.
Audit Metadata