jmeter-load-testing
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and examples for executing JMeter load tests using the CLI (
jmeter -n ...) and via Docker containers (docker run apache/jmeter ...). This is the primary functionality of the skill and is well-documented. - [EXTERNAL_DOWNLOADS]: The skill references and uses official resources from the Apache Software Foundation, including the JMeter binaries and Docker images. It also utilizes standard GitHub Actions (
actions/checkout,actions/cache,actions/upload-artifact) for CI integration. All external sources are well-known and reputable services. - [INDIRECT_PROMPT_INJECTION]: The skill defines processes for ingesting and parsing external data files, such as JMeter results (JTL) and test plans (JMX).
- Ingestion points: Files
ci/gate.mjs(reads.jtlfiles) andtools/plan-lint.mjs(reads.jmxfiles) ingest external data into the agent context. - Boundary markers: The scripts do not implement specific boundary markers or "ignore instructions" delimiters for the data files.
- Capability inventory: The scripts are limited to file reading (
readFileSync), string manipulation (split, regex), and JSON parsing (JSON.parse). They do not perform network operations, file writes, or dynamic code execution on the ingested data. - Sanitization: No sanitization is performed on the input data, but the limited capabilities of the scripts minimize the risk of malicious payload execution.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill is designed for performance testing education and evaluation, and all identified functional flaws are intentional components of the provided evaluation tasks.
Audit Metadata