a11y-audit

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @axe-core/cli package. This is a widely recognized and industry-standard tool for accessibility testing.
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform its audit functions:
  • Runs grep to scan JSX, TSX, and HTML files for static accessibility violations.
  • Runs npx @axe-core/cli@4 http://localhost:3000 to perform dynamic analysis against a local development server.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes untrusted project source code.
  • Ingestion points: Processes package.json and project files with extensions like .html, .jsx, .tsx, and .vue as specified in SKILL.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded content are defined.
  • Capability inventory: The agent has the capability to execute shell commands (grep, npx) and read local files.
  • Sanitization: No explicit sanitization or filtering of the processed file content is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:44 PM
Security Audit — agent-trust-hub — a11y-audit