The Agent Skills Directory

[SAFE]: The skill is primarily instructional, providing guidelines for WCAG 2.2 AA conformance. All included code snippets and logic are standard for accessibility testing and do not perform any sensitive operations or network communications.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of web source code or rendered artifacts. Although this is a vulnerability surface, the risk is minimal as the agent's actions are restricted to reporting and suggesting fixes. Evidence chain: 1) Ingestion point: 'rendered artifact or source' input; 2) Boundary markers: structured 'repair ledger' output table; 3) Capability inventory: reporting and text-based repair suggestions only (no subprocess, file-write, or network operations); 4) Sanitization: focuses on reporting observed defects rather than executing provided code.
[COMMAND_EXECUTION]: A JavaScript utility (assets/audit.js) is included for the user to manually run in their browser devtools. Analysis of this script confirms it only performs local DOM inspection and color contrast calculations. It contains no network requests, data exfiltration logic, or obfuscation.

a11y-pass