The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates its auditing pipeline using subprocess.run to call internal scripts (e.g., finalize_visual_review.py calling audit_ui.py). These implementations follow security best practices by disabling shell interpolation (shell=False) and resolving executable paths via shutil.which to prevent path-based command injection.
[DYNAMIC_EXECUTION]: Browser-side JavaScript is executed via Playwright's page.evaluate to perform in-depth DOM analysis for WCAG contrast compliance and motion risk detection. The code executed is statically defined within the skill's scripts/contrast_probe.js and runs within the browser's sandbox environment.
[SAFE]: No malicious patterns such as credential exfiltration, prompt injection, or unauthorized network operations were detected. The skill's behavior is consistent with its stated purpose of visual quality assurance.

visual-auditor