experience-lwc-accessibility-validate
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data (LWC source code and component screenshots) to identify accessibility violations. This creates an attack surface for indirect prompt injection, where malicious instructions could be embedded within the analyzed content to influence the agent's behavior. (1) Ingestion points: Source code and images provided by the user for review. (2) Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided in the skill's reference files. (3) Capability inventory: The skill executes a local Python script for mathematical calculations. (4) Sanitization: No explicit sanitization or filtering of the processed content is performed within the provided scripts.
- [SAFE]: The included utility scripts/contrast-ratio.py performs deterministic mathematical calculations of color contrast ratios using only standard Python libraries (argparse, json, re, sys). It does not perform network operations, access sensitive files, or use dynamic code execution.
- [SAFE]: The skill's instructions, metadata, and reference files are consistent with its stated purpose of accessibility auditing and do not contain obfuscation, hidden URLs, or malicious redirection.
Audit Metadata