accessibility
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/accessibility_scanner.pyusessubprocess.runto invoke theaxecommand-line tool. This is a functional requirement for performing accessibility audits and follows safe coding practices by using a list of arguments rather than a shell string. - [EXTERNAL_DOWNLOADS]: The skill instructions and scripts refer to the installation and use of
@axe-core/cliandaxe-core. These are well-known, reputable open-source tools maintained by Deque Systems for accessibility testing. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect injection surface as it ingests data from external URLs during the scanning process.
- Ingestion points:
scripts/accessibility_scanner.pyreads JSON output from theaxecommand, which includes content such as HTML snippets from the targeted URL. - Boundary markers: No specific delimiters or "ignore instructions" warnings are used when embedding HTML snippets into the JSON report or markdown templates.
- Capability inventory:
subprocess.runis present inscripts/accessibility_scanner.pyfor executing audit commands. - Sanitization: HTML snippets are truncated to 300 characters before inclusion in reports.
Audit Metadata