The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute an external package using npx -y @a11y-skills/audit:*. This package originates from an unverified source not identified as a trusted organization or well-known service in the security guidelines.
[COMMAND_EXECUTION]: The skill uses shell commands to perform audits and install dependencies. This includes running the audit CLI for page analysis. It also uses npx playwright install:* to set up browser environments, which leverages a well-known service from a trusted organization.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, creating a potential attack surface for indirect prompt injection.
Ingestion points: The skill uses WebFetch and Playwright tools to retrieve content from arbitrary URLs provided by the user, and the Read tool to access local source code files.
Boundary markers: There are no explicit instructions to use delimiters or "ignore embedded instructions" warnings when the agent processes the retrieved content.
Capability inventory: The agent has extensive capabilities including Bash execution, browser interaction (click, key press), and file system access.
Sanitization: No explicit sanitization or validation of the fetched HTML or source code is performed before analysis.
[EXTERNAL_DOWNLOADS]: The skill connects to external URLs (web pages and Figma designs) to retrieve content for review. This is an expected part of its functionality but involves interacting with untrusted domains.

reviewing-a11y