load-testing-apis
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates JavaScript (k6) and YAML (Artillery) scripts based on API route definitions and user-defined scenarios, which are then executed to perform load tests. This is a core functionality of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and processes external API specifications and route definitions using
GlobandReadtools to build endpoint lists.\n - Ingestion points: Reading API specifications and route definitions from the local file system using the
Readtool.\n - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing steps.\n
- Capability inventory: The skill has the capability to write files and execute commands via the
Bashtool (restricted toapi:load-*prefix).\n - Sanitization: There is no mention of sanitizing or validating the content of the API specifications before processing.\n- [COMMAND_EXECUTION]: The skill uses the
Bashtool restricted to a specific namespace (api:load-*) and recommends the use of external command-line utilities such ask6,artillery,wrk, andnpxfor executing tests and generating reports.
Audit Metadata