performance-test-gatling
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a GitHub Actions workflow (
examples/ci/github-actions-gatling.yml) that downloads the official Gatling bundle from Maven Central (repo1.maven.org). This is a well-known and trusted package registry. - [COMMAND_EXECUTION]: Shell scripts (
scripts/run-tests.sh,scripts/run-local-smoke.sh) are included to automate test execution. These scripts facilitate running the Gatling CLI and a local mock server for testing purposes using standard subprocess calls. - [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management by utilizing environment variables (
BASE_URL,ENV) and CI/CD secret management (e.g.,secrets.PERF_BASE_URLin GitHub Actions) instead of hardcoding sensitive data. Templates include placeholders likemock-tokenand explicit instructions to avoid real secrets. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes user-provided API details and load requirements. However, it mitigates this risk through strict instructions in
prompts/performance-test-gatling.mdthat mandate the use of placeholders, unconfigured variables for missing data, and explicit warnings against inventing information or using real secrets. - [DYNAMIC_EXECUTION]: Local Python tools (
scripts/tools/summarize_gatling.py,scripts/tools/compare_gatling.py) use standardjson.loadsfor processing Gatling results, which is a safe practice compared to insecure deserialization methods.
Audit Metadata