k6
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes standard installation commands using package managers such as brew, apt, and choco. These are instructional and intended for user-initiated setup.
- [EXTERNAL_DOWNLOADS]: The example scripts reference external JavaScript modules from jslib.k6.io and a community-maintained reporter on GitHub. These are recognized sources for k6 extensions and utilities.
- [CREDENTIALS_UNSAFE]: Several code snippets use placeholder credentials like 'token123', 'admin', and '123' for demonstration purposes. These do not expose actual sensitive data.
- [INDIRECT_PROMPT_INJECTION]: The skill documents the use of SharedArray to ingest local CSV and JSON files for data-driven testing. While this involves data ingestion, it is a standard tool feature for processing local test data.
- Ingestion points: Reads local data files specified in the script examples via the
open()function. - Boundary markers: None present in the documentation snippets.
- Capability inventory: Perform HTTP requests and browser-based UI automation.
- Sanitization: None specified, as the data is local and managed by the test author.
Audit Metadata