k6-test-maintenance
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
k6andgcxCLI tools to perform script validation (k6 inspect), local smoke tests (k6 run), and to interact with Grafana Cloud APIs for script management. - [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of helper libraries from
https://jslib.k6.io, which is the official and well-known repository for k6 utility modules. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes untrusted k6 scripts provided by users or fetched from remote sources.
- Ingestion points: Reads local files from the disk and cloud-hosted scripts via the
k6-managetool. - Boundary markers: There are no explicit instructions or delimiters defined to isolate script content when it is interpolated into the agent's context during analysis or modification.
- Capability inventory: The skill has the capability to execute shell commands (
k6,gcx), write files to the local system, and perform network operations via Grafana Cloud tools. - Sanitization: The skill mitigates risks by implementing a mandatory validation loop using
k6 inspectandvalidate_scriptto ensure scripts are syntactically correct before they are presented or deployed.
Audit Metadata