load-testing-apis

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates JavaScript (k6) and YAML (Artillery) scripts based on API route definitions and user-defined scenarios, which are then executed to perform load tests. This is a core functionality of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and processes external API specifications and route definitions using Glob and Read tools to build endpoint lists.\n
  • Ingestion points: Reading API specifications and route definitions from the local file system using the Read tool.\n
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing steps.\n
  • Capability inventory: The skill has the capability to write files and execute commands via the Bash tool (restricted to api:load-* prefix).\n
  • Sanitization: There is no mention of sanitizing or validating the content of the API specifications before processing.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool restricted to a specific namespace (api:load-*) and recommends the use of external command-line utilities such as k6, artillery, wrk, and npx for executing tests and generating reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:44 AM