The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/accessibility_scanner.py uses subprocess.run to execute the @axe-core/cli binary. While the implementation avoids shell injection by using a command list, it executes an external tool based on the provided URL.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes content from external URLs, which creates a potential vector for indirect prompt injection. Ingestion points: scripts/accessibility_scanner.py extracts and formats HTML snippets and failure summaries from target websites via axe-core. Boundary markers: No delimiters or explicit ignore instructions are present to separate external content from the agent's prompt context. Capability inventory: subprocess.run (to execute the axe scanner) and file output capabilities. Sanitization: The script truncates HTML snippets to 300 characters but does not perform escaping, filtering, or sanitization of the external content.
[EXTERNAL_DOWNLOADS]: The skill requires external Node.js dependencies (@axe-core/cli and axe-core) and references an installation script (scripts/install-external-skills.py) located outside the skill's own directory structure as part of its setup documentation.

accessibility