k6-load-testing
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for reading external data from CSV and JSON files (
users.csv,products.json) to parameterize load tests. - Ingestion points:
open('./users.csv')andopen('./products.json')are used withinSharedArrayconstructors inSKILL.md. - Boundary markers: None present; data is split by newlines or parsed as JSON and directly used in request payloads.
- Capability inventory: The skill utilizes
http.get,http.post, andws.connectto perform network operations based on the ingested data. - Sanitization: No explicit sanitization or validation of the file content is shown before it is used in network requests.
- [COMMAND_EXECUTION]: Provides standard shell commands for installing the k6 utility using system package managers like Homebrew, Chocolatey, and APT.
- [EXTERNAL_DOWNLOADS]: References official software repositories (
dl.k6.io) and established GitHub Actions (grafana/k6-action) for setup and CI/CD integration. - [PRIVILEGE_ESCALATION]: Includes
sudocommands within the Linux installation section to manage GPG keys and system package lists, which is the standard procedure for installing official developer tools.
Audit Metadata