k6-perf-test-website
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to monitor load-generator performance. These tools use standard system commands like ps, top, and netstat to collect resource metrics (CPU, memory, NIC) during test execution.
- [EXTERNAL_DOWNLOADS]: The skill downloads official k6 utility libraries from jslib.k6.io and uses standard npm packages like Playwright. These are well-known, trusted resources for performance testing.
- [INDIRECT_PROMPT_INJECTION]: The skill handles HTTP Archive (HAR) files as input for test generation. This ingestion surface is managed through documented manual sanitization and cleanup procedures, mitigating the risk of instructions embedded in recorded traffic. Mandatory Evidence Chain: 1. Ingestion points: recordings/har/ HAR files. 2. Boundary markers: urlFilter regex in recorder template. 3. Capability inventory: k6 network calls and shell script monitoring. 4. Sanitization: Manual hand-cleaning process in references/functional-tests.md.
- [SAFE]: The skill includes extensive security guidance, such as advising against committing session cookies and providing templates that parameterize URLs and credentials to avoid exposure.
Audit Metadata