locusts_mcp

The application allows configuration via file paths (`CONFIG_PATH` environment variable) and environment variable overrides. While common for configuration, if the execution environment is untrusted, an attacker could manipulate `CONFIG_PATH` to load a malicious configuration file from an arbitrary location on the system, potentially directing the Locust client to perform unintended network requests or access sensitive local files if the 'payload' or 'headers' fields are exploited by the target API. Hardcoded test tokens are present in example config files, emphasizing the need for users to manage their secrets carefully. No direct 'eval' or 'os.system' calls are observed that would execute arbitrary code on the host machine from user input within the `locustfile.py` itself.