skills/iwanhe/pandawa/a11y-audit/Gen Agent Trust Hub

a11y-audit

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The provided Python scripts, a11y_scanner.py and contrast_checker.py, are implemented using only the Python standard library. They do not require the installation of third-party packages or download code from external sources.
  • [SAFE]: All auditing operations are performed locally. The scripts read local files for analysis and print results to the standard output, with no evidence of network requests or data exfiltration logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code as input for scanning, which represents a potential injection surface.
  • Ingestion points: scripts/a11y_scanner.py reads file content using open() calls to perform regex-based auditing.
  • Boundary markers: The scanner processes the file content directly without delimiters or explicit boundary isolation.
  • Capability inventory: The skill is limited to static analysis and terminal output; it lacks capabilities for network access, arbitrary file writes, or command execution.
  • Sanitization: No input sanitization is performed on the read content, as the tool's output is restricted to diagnostic information for the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 02:33 PM
Security Audit — agent-trust-hub — a11y-audit