The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a node -e shell command snippet in SKILL.md intended to update the run-history.json file. This pattern involves direct shell execution and file system write operations within the skill directory.
[DYNAMIC_EXECUTION]: The history update mechanism in SKILL.md relies on string interpolation of variables (P95, RPS, ERR) into a Node.js script. If these variables are populated by the agent using unvalidated or malicious tool outputs, it could lead to code or command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze output from external performance testing tools, creating a vulnerability surface.
Ingestion points: Performance metrics, SLAs, and logs from tools such as k6, Artillery, and JMeter (as referenced in SKILL.md and evals/performance-testing.yaml).
Boundary markers: Absent; there are no specific delimiters defined to separate external data from the agent's internal instructions.
Capability inventory: Shell execution (node -e) and file system writes (fs.writeFileSync) are used to process results.
Sanitization: Absent; the skill does not explicitly provide validation or sanitization steps for ingested metrics before their use in script interpolation.
[EXTERNAL_DOWNLOADS]: The skill references the official grafana/k6-action GitHub Action for CI/CD workflows. This reference targets a well-known service for its intended primary purpose and is documented neutrally.

performance-testing