testland/k6-load-testing
Authors k6 JavaScript load-test scripts (VU loops + checks + sleeps), configures the `options` block with `stages` (ramp-up patterns) and `thresholds` (p(95) latency, error rate), runs via `k6 run script.js` or `--vus / --duration` ad-hoc flags, and uses thresholds as the CI pass/fail signal. Includes a latency-percentile interpretation reference: tail ratio (p99/p50), bimodal-distribution detection, coordinated omission and why naive p99 is optimistic, and constant-vus vs constant-arrival-rate executors. Use when the project ships HTTP / WebSocket / gRPC load tests and the team wants developer-friendly JavaScript authoring, or when a k6 threshold passes but the system still feels slow.
72
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The GitHub Actions CI installs k6 at runtime by adding the remote apt repo (https://dl.k6.io/deb) and retrieving a GPG key from hkp://keyserver.ubuntu.com:80, which fetches and installs remote package binaries that the skill then executes/depends on.
Where we found it
k6 (via apt from https://dl.k6.io/deb)
dependency · 2 sites
The CI workflow adds a remote third-party apt repository (https://dl.k6.io/deb) and installs the k6 package from it at runtime, fetching unverifiable remote binaries.
references/ci-integration.md
31
echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" | sudo tee /etc/apt/sources.list.d/k6.list
references/ci-integration.md
33
sudo apt-get install k6
hkp://keyserver.ubuntu.com:80
url · 1 site
The CI workflow fetches a GPG key from a remote keyserver (hkp://keyserver.ubuntu.com:80) at runtime to verify the k6 apt repository, introducing an external dependency on key retrieval.
references/ci-integration.md
30
--keyserver hkp://keyserver.ubuntu.com:80 --recv-keys [REDACTED]
actions/checkout@v5
dependency · 1 site
The CI workflow invokes the hosted GitHub Action actions/checkout@v5, a remote dependency fetched and executed at runtime.
references/ci-integration.md
24
- uses: actions/checkout@v5
actions/upload-artifact@v4
dependency · 1 site
The CI workflow invokes the hosted GitHub Action actions/upload-artifact@v4, a remote dependency fetched and executed at runtime.
references/ci-integration.md
47
uses: actions/upload-artifact@v4
- Audited
- Security analysis