accessibility

Pass

Audited by Gen Agent Trust Hub on Jul 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/accessibility_scanner.py uses subprocess.run to invoke the axe command-line tool. This is a functional requirement for performing accessibility audits and follows safe coding practices by using a list of arguments rather than a shell string.
  • [EXTERNAL_DOWNLOADS]: The skill instructions and scripts refer to the installation and use of @axe-core/cli and axe-core. These are well-known, reputable open-source tools maintained by Deque Systems for accessibility testing.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect injection surface as it ingests data from external URLs during the scanning process.
  • Ingestion points: scripts/accessibility_scanner.py reads JSON output from the axe command, which includes content such as HTML snippets from the targeted URL.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are used when embedding HTML snippets into the JSON report or markdown templates.
  • Capability inventory: subprocess.run is present in scripts/accessibility_scanner.py for executing audit commands.
  • Sanitization: HTML snippets are truncated to 300 characters before inclusion in reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 5, 2026, 04:24 PM
Security Audit — agent-trust-hub — accessibility