code-quality-checks
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several well-known and industry-standard Node.js packages via NPM for linting and accessibility checks, including
htmlhint,csslint,linkinator, and@axe-core/cli. - [COMMAND_EXECUTION]: The skill executes shell commands to install global packages and run validation tools. It also starts a temporary local HTTP server using Python's built-in module to facilitate recursive link checking of local files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided HTML and CSS files. While these files represent an external data surface, the linters and accessibility tools perform static analysis and do not execute the content as code, posing negligible risk.
- Ingestion points: Local project files (
*.html,styles.css) are read by the analysis tools inSKILL.md. - Boundary markers: Absent.
- Capability inventory: Shell command execution, package installation, and local network listener (
python3 -m http.server) inSKILL.md. - Sanitization: Absent; the tools rely on static parsing of the file formats.
Audit Metadata