151-java-performance-jmeter
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill creates a bash script (
run-jmeter.sh) and explicitly instructs the agent to make it executable usingchmod +x. This is a standard and expected operation for the skill's purpose of setting up a local testing environment. - [COMMAND_EXECUTION]: The skill verifies prerequisites by executing
jmeter --versionand the provided script executes thejmeterbinary to perform load tests. These are legitimate uses of the tool required for the skill's primary function. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process an external JMeter test plan file (
load-test.jmx). While this represents a data ingestion surface, it is the intended use case for performance testing tools. - Ingestion points: The file
src/test/resources/jmeter/load-test.jmxis read by the JMeter tool during execution. - Boundary markers: None present for the test plan content.
- Capability inventory: The skill can modify file permissions (
chmod) and execute thejmetercommand line tool. - Sanitization: The script uses shell variables for configuration but does not perform explicit sanitization of the JMX file content, relying on JMeter's own processing logic.
Audit Metadata