k6-test-maintenance

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the k6 and gcx CLI tools to perform script validation (k6 inspect), local smoke tests (k6 run), and to interact with Grafana Cloud APIs for script management.
  • [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of helper libraries from https://jslib.k6.io, which is the official and well-known repository for k6 utility modules.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes untrusted k6 scripts provided by users or fetched from remote sources.
  • Ingestion points: Reads local files from the disk and cloud-hosted scripts via the k6-manage tool.
  • Boundary markers: There are no explicit instructions or delimiters defined to isolate script content when it is interpolated into the agent's context during analysis or modification.
  • Capability inventory: The skill has the capability to execute shell commands (k6, gcx), write files to the local system, and perform network operations via Grafana Cloud tools.
  • Sanitization: The skill mitigates risks by implementing a mandatory validation loop using k6 inspect and validate_script to ensure scripts are syntactically correct before they are presented or deployed.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 04:45 PM
Security Audit — agent-trust-hub — k6-test-maintenance