The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates multiple JavaScript files (_a11y_scan.mjs, _a11y_keyboard.mjs, and _a11y_auth.mjs) at runtime and executes them using node. This pattern of script generation and execution increases the risk of arbitrary code execution if the templates are manipulated.
[COMMAND_EXECUTION]: The skill invokes system package managers (pnpm, npm, yarn) to install axe-core as a development dependency. It also uses curl to interact with local servers and find to traverse the file system.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill writes sensitive application data to the /tmp directory, including screenshots of the UI and authentication session states (/tmp/a11y-auth-state.json). Storing session tokens in shared temporary directories can lead to credential exposure in multi-user environments.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the application under test, including UI content analyzed by axe-core and source code scanned via grep. This creates a vulnerability surface where malicious content within the application could influence the agent's behavior.
Ingestion points: UI content captured via Playwright/axe-core and application source code files (.tsx, .jsx, .css).
Boundary markers: None identified. The agent processes the resulting JSON reports and code snippets directly.
Capability inventory: File system writes, shell command execution (node, npm/pnpm/yarn, curl), and source code modification.
Sanitization: No sanitization or validation of the ingested external content is performed before processing.

a11y