The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill uses sudo to perform administrative actions, including adding a GPG key, creating a new repository list file in /etc/apt/sources.list.d/, and installing the k6 package.
[CREDENTIALS_UNSAFE]: Contains hardcoded credentials (Password!23) intended for authentication flows in the load test scenarios.
[DYNAMIC_EXECUTION]: Instructs the agent to create JavaScript files (e.g., tests/load/load.js) and subsequently execute them using the k6 binary. This pattern of generating and then executing code at runtime is a risk factor.
[COMMAND_EXECUTION]: Executes several shell commands, including pnpm run seed to initialize the database and curl combined with jq to parse API paths from a remote endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could influence agent behavior.
Ingestion points: Fetches API path data from ${API_BASE_URL}/api-json and reads endpoint definitions from projects/app/app/api/sdk.gen.ts.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when processing this data.
Capability inventory: The skill possesses high-privilege capabilities including sudo execution, general command execution (pnpm, k6), and network access via curl.
Sanitization: No sanitization or validation of the ingested API paths or SDK content is mentioned before they are used to generate test scripts.
[EXTERNAL_DOWNLOADS]: Fetches the k6 load testing tool from official repositories and releases. While these are well-known services (Grafana's GitHub and k6's official Debian repository), the skill automates the download and installation process.

running-load-tests-with-k6