api-load-tester — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited api-load-tester (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Stress-test HTTP endpoints under increasing load, identify breaking points, and produce a report with actionable recommendations.
references/tool-commands.md -- tool invocations (hey/wrk/ab/curl), default concurrency stages, per-stage data to capture.references/metrics-interpretation.md -- latency, throughput, error, breaking-point, and bottleneck classification.references/output-template.md -- exact structure for api-load-report.md, including ASCII charts and scaling table.references/rules-and-examples.md -- safety rules, error handling, and example invocations.Collect from the user. Ask before proceeding if a required input is missing.
Required: endpoint URL(s) (with method, headers, body as needed); expected latency thresholds. Default thresholds if unspecified: p50 < 100ms, p95 < 300ms, p99 < 1000ms.
Optional: concurrent users or range (default ramp 1 to 100); authentication; request payloads; custom headers; test duration (default 10s per stage); ramp pattern (default step ramp, doubling each stage); success criteria (default 2xx); known rate limits; environment label (prod/staging/dev).
Follow these steps in order.
which hey, which wrk, which ab, which curl. If none of hey/wrk/ab exist, install hey (brew install hey on macOS, go install github.com/rakyll/hey@latest on Linux with Go) or fall back to curl with bash background processes and wait. Verify with a single trivial request against a provided endpoint; diagnose connectivity or auth before continuing.references/tool-commands.md for the default progression), trimming or extending to the user's concurrency range. Define per-endpoint method, URL, headers, body, success codes, and timeout (default 30s). Print the plan for review before executing.references/tool-commands.md for commands, request-count formula, and the metrics list.references/metrics-interpretation.md.api-load-report.md to the current working directory following references/output-template.md exactly, including ASCII throughput and latency charts.Apply the safety rules, error handling, and example invocations in references/rules-and-examples.md. Key constraints: never load-test production without explicit confirmation, only test GET by default, mask auth tokens, respect 429 rate limits, count timeouts as failures, and never extrapolate beyond tested ranges.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.