running-load-tests-with-k6

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit test credentials (user emails and the password "Password!23") and shows them being inserted verbatim into k6 scripts (login calls), so the LLM would be required to output secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Step 1 instructs fetching and installing the k6 binary at runtime from external sources (e.g., https://dl.k6.io/deb and https://github.com/grafana/k6/releases/latest, or pulling the Docker image grafana/k6:latest), which downloads remote code that will be executed and is a required dependency for running the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running sudo commands that write to /usr/share/keyrings and /etc/apt/sources.list.d and to install packages with apt, which requires elevated privileges and modifies system-level files.