gatling-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scaffold.sh and scaffold.ps1 scripts configure new projects to download the Gradle distribution from services.gradle.org. This is an official and well-known source for the Gradle build tool and is documented neutrally as standard project configuration.
  • [COMMAND_EXECUTION]: The skill provides automated scripts for scaffolding projects and validating simulation quality. The documentation includes safety instructions for the agent to avoid executing interactive scripts directly in the terminal, which reduces the risk of process hangs.
  • [INDIRECT_PROMPT_INJECTION]: The validate.sh script performs static analysis on user-provided source code files to ensure they follow Gatling best practices. This ingestion of untrusted external content represents a potential indirect prompt injection surface.
  • Ingestion points: The validate.sh script uses find and cat to read all source files within the user's project src/ directory.
  • Boundary markers: No explicit delimiters or boundary markers are used when the content of user files is read and processed.
  • Capability inventory: The skill has the capability to write project files and execute shell scripts via the agent's tools.
  • Sanitization: The validation process uses grep for pattern matching on the file contents but does not perform sanitization of the content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 08:27 AM