Skills
skills/kevinzai/cc-commander/accessibility-compliance-accessibility-audit/Gen Agent Trust Hub

accessibility-compliance-accessibility-audit

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The implementation playbook provides Javascript code that utilizes Puppeteer to launch and control browser instances.
  • Evidence: The AccessibilityAuditor class in resources/implementation-playbook.md uses puppeteer.launch() and page.goto(url) to interact with web pages.
  • [EXTERNAL_DOWNLOADS]: The skill references well-known testing libraries and official GitHub Actions for CI/CD integration.
  • Evidence: The playbook suggests using @axe-core/puppeteer, puppeteer, and pa11y. The GitHub Action example in resources/implementation-playbook.md uses official actions/checkout@v3, actions/setup-node@v3, and actions/upload-artifact@v3 workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing content from external URLs, which represents a potential attack surface.
  • Ingestion points: The url parameter in the runFullAudit function within resources/implementation-playbook.md allows the agent to fetch external web content.
  • Boundary markers: None identified; the skill does not explicitly instruct the agent to ignore directives embedded in audited web pages.
  • Capability inventory: The skill uses Puppeteer for network requests and page interaction, and generates reporting data based on the analysis.
  • Sanitization: Content is processed for accessibility violations via axe-core, but is not sanitized against prompt injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 05:35 AM
Security Audit — agent-trust-hub — accessibility-compliance-accessibility-audit