k6-performance
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the PapaParse library from the official k6 JavaScript library repository (jslib.k6.io) to enable CSV data parsing within performance tests.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions demonstrate patterns for ingesting data from external files and network responses, creating a potential surface for instructions embedded in untrusted data to influence agent behavior.
- Ingestion points: The scripts in
SKILL.mdread local CSV and JSON files usingopen('./data/users.csv')andopen('./data/payloads.json'), and they parse remote server response bodies usingJSON.parse(response.body). - Boundary markers: The provided templates do not include specific delimiters or instructions to ignore potential commands embedded within the ingested test data or API payloads.
- Capability inventory: The skill facilitates the execution of performance tests via the
k6command-line tool, which performs various network operations. - Sanitization: There is no explicit sanitization or validation logic shown for the content retrieved from external files or network endpoints before it is processed by the script logic.
Audit Metadata