The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill attempts to install the hey load testing tool from a third-party GitHub repository (github.com/rakyll/hey) using go install if the tool is not found on the system during initialization.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands (hey, wrk, ab, curl) to perform load tests. User-provided inputs such as URLs, HTTP headers, and request bodies are interpolated into these commands, which presents a significant risk of command injection if the inputs contain shell metacharacters.
[DYNAMIC_EXECUTION]: The skill generates and executes a multi-line Bash script as a fallback when specialized load-testing tools are unavailable. This script uses nested loops and background processes to simulate concurrent requests using curl with user-supplied parameters.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of endpoint URLs and request parameters, which are then used to influence the execution of shell commands.
Ingestion points: Endpoint URLs, authentication tokens, headers, and request bodies provided by the user as described in SKILL.md (Workflow Step 2 and 3).
Boundary markers: No explicit delimiters or sanitization instructions are provided to the agent to ensure that user-supplied strings are treated as data rather than executable code within the shell commands.
Capability inventory: The skill uses Bash, Read, Write, Glob, and Grep to execute network requests, handle local files, and manage report output.
Sanitization: The instructions do not specify any validation, escaping, or filtering mechanisms for user-supplied input before interpolation into CLI tool arguments.

api-load-tester