The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions (SKILL.md, Step 3) direct the agent to "detect and reuse the repository's package manager, start command, browser tests, accessibility libraries, and reporting conventions." This behavior causes the agent to execute arbitrary, untrusted shell commands and scripts defined by the project being audited, which could lead to unauthorized system access or command injection.
[REMOTE_CODE_EXECUTION]: The workflow encourages the use of project-local or ephemeral axe CLIs and accessibility libraries. If these dependencies are not already present, the agent may attempt to download and install them from external sources without explicit verification of their integrity or origin.
[DATA_EXFILTRATION]: While the included script scripts/compare-evidence.mjs is limited to local file reading and JSON comparison, the broader instruction to run project-specific "browser tests" and "start commands" provides a significant surface for exfiltrating local project data if those scripts contain network calls or unauthorized file access.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon content from the audited repository, including package.json files and automated test results, without sanitization or boundary markers.
Ingestion points: Target project configuration files (e.g., package.json), test scripts, and axe-core result JSON files.
Boundary markers: None present; the agent treats the project's metadata and output as authoritative configuration.
Capability inventory: File system read/write access and shell command execution via project scripts.
Sanitization: No escaping or validation is performed on the data ingested from the project environment.

a11y-maxxing