k6-performance

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains hardcoded plaintext passwords (e.g., "SecurePass123!") and instructs embedding credentials from CSV/JSON into HTTP requests, which forces the LLM to reproduce or handle secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill imports and executes remote JavaScript at runtime from https://jslib.k6.io/papaparse/5.1.1/index.js (used by the k6 script to parse CSVs), so externally fetched code will be executed and is a required dependency.