k6-perf-test-website

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to "capture ... credentials" in the runbook and to replace/store session tokens (and to elicit auth-related info), which requires the LLM to receive and potentially write secret values verbatim into files and outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The k6 test scripts import remote modules that are fetched and executed at runtime (e.g. import { expect } from 'https://jslib.k6.io/k6-testing/0.5.0/index.js' and import { check as asyncCheck } from 'https://jslib.k6.io/k6-utils/1.5.0/index.js'), so these external URLs are runtime dependencies that deliver executable code the skill relies on.