a11y-audit

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The scripts/contrast.mjs utility dynamically imports the project's local Tailwind configuration file using await import() to extract color tokens for contrast calculation. This operation is restricted to project files and is necessary for the skill's core functionality.
  • [COMMAND_EXECUTION]: The skill workflow involves executing rg (ripgrep) to perform source code audits and running a local Node.js script to evaluate color contrast ratios. These commands are documented and used exclusively for analytical purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes source code from the target repository, representing a potential surface for indirect instructions if malicious content is present in the audited code.
  • Ingestion points: Project source files analyzed via rg patterns in references/audit-lenses.md and SKILL.md.
  • Boundary markers: The instructions lack explicit data delimiters but provide a manual verification step, advising the agent to "Verify load-bearing claims first-hand before they go in the report."
  • Capability inventory: File reading/writing, shell command execution (rg), and local script execution.
  • Sanitization: Findings are evaluated by the agent based on specific WCAG criteria, but no programmatic sanitization is applied to raw code matches during the initial grep phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:59 AM