performance-testing

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions example includes external actions referenced as "uses: grafana/k6-action@v0.3.0" (and other actions like actions/checkout@v4), which are fetched and executed at CI runtime and thus constitute runtime external dependencies that execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit payment-related operations: k6 and Locust scripts POST to a /payments endpoint with an amount and authorization token, and the Go benchmarks call svc.ProcessPayment(Payment{Amount: ...}). These are specific API calls/functions that create/process payments (i.e., move money), not generic tooling, so it grants direct financial execution capability.