The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the axe-core library from Cloudflare's public CDN (cdnjs.cloudflare.com). This is a well-known service used for delivering web assets and is necessary for the runtime scanning functionality.
[COMMAND_EXECUTION]: The skill executes package managers (npm, pnpm, yarn) to install the standard eslint-plugin-jsx-a11y dependency and runs the project's own development server. These actions are transparently documented as part of the audit procedure.
[DYNAMIC_EXECUTION]: The skill generates a temporary configuration file (eslint.a11y.mjs) to ensure compatibility with different ESLint versions. This script generation is restricted to a fixed template for tool configuration.
[INDIRECT_PROMPT_INJECTION]: The skill represents a potential surface for indirect injection as it ingests untrusted project data (source code and rendered HTML) for analysis. However, given its primary purpose as an audit tool, this is an inherent risk managed by the agent's internal boundaries.
[INGESTION_POINTS]: Project source files (.tsx, .jsx) and rendered DOM content during browser automation.
[BOUNDARY_MARKERS]: None explicitly defined for scanned content.
[CAPABILITY_INVENTORY]: Subprocess execution for dependency installation, starting/stopping local servers, and file creation/deletion.
[SANITIZATION]: The skill does not perform sanitization on the code it audits, as its purpose is to report on that code's structure.

accessibility-audit