web-accessibility-wizard

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill explicitly mandates that the agent "MUST Ask Questions Before Doing Anything" (Phase 0 guardrail) but then instructs the agent to "silently check the workspace for CI-based accessibility scanners" before asking the user — a hidden, contradictory action that directs undisclosed behavior outside the stated interactive flow.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to "ask for credentials" and to "request session cookies or auth tokens" and to pass cookies/tokens to scanning tools (e.g., via --cookie), which requires the LLM to receive and embed secret values verbatim in commands/requests, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow includes running npx @axe-core/cli <URL> (Phase 9) against a user-provided dev/production URL, which causes the agent to ingest rendered page content (outsider-authored web page text/DOM) into the LLM context via the scan results/reporting.