The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The README.md documentation recommends using powershell -ExecutionPolicy Bypass to run the installation script on Windows. This instruction encourages users to bypass a security feature designed to prevent the execution of untrusted scripts.
[COMMAND_EXECUTION]: The skill provides scripts/run-tests.sh, a bash script that executes the jmeter command. The AI is also instructed to guide users in running non-GUI JMeter commands, which involves local shell execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to analyze external data such as JMX test plans and JTL log files.
Ingestion points: evals/fixtures/jmx/check_jtl.py reads CSV-formatted JTL results. evals/fixtures/check_domain_decisions.py reads data from the EVAL_FINAL_MESSAGE environment variable.
Boundary markers: The skill does not implement explicit boundary markers or instructions for the agent to ignore potentially malicious embedded content in these data sources.
Capability inventory: The skill is capable of executing shell commands via scripts/run-tests.sh and contains executable Groovy scripts within its JMX fixtures (evals/fixtures/jmx/business-oracle.jmx).
Sanitization: No evidence of sanitization or input validation for these data sources was found in the provided scripts.

performance-test-jmeter