k6-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a code generation assistant for performance testing scripts. Ingestion points: User-supplied parameters for endpoints, protocols, and performance goals described in SKILL.md. Boundary markers: The skill does not establish explicit boundary markers or isolation for untrusted user input within the generated scripts. Capability inventory: The generated output is intended for execution via the k6 CLI and esbuild as documented in SKILL.md and references/DESIGN-PATTERNS.md. Sanitization: There are no explicit rules for sanitizing or validating user input during the code generation process.
- [EXTERNAL_DOWNLOADS]: The documentation references external utility libraries during script construction. Evidence: Usage of https://jslib.k6.io/k6-utils/1.4.0/index.js in references/DESIGN-PATTERNS.md. Note: This resource is from the official k6 community library repository.
- [COMMAND_EXECUTION]: The skill includes instructions and examples for executing shell commands to run load tests and build TypeScript projects. Evidence: Multiple instances of k6 run, npx esbuild, and k6 cloud run commands in SKILL.md and references/DESIGN-PATTERNS.md.
Audit Metadata