The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code changes to perform accessibility reviews, which could allow malicious instructions in the code to influence the agent's behavior. (1) Ingestion points: staged files, working diffs, and branch comparisons. (2) Boundary markers: None. (3) Capability inventory: Bash execution of a bundled Node.js script via a platform-defined tool path. (4) Sanitization: The instructions require the agent to cite code evidence for findings, providing a manual verification step.
[REMOTE_CODE_EXECUTION]: The skill documentation mentions a fallback npx -y ultra11y command for use in environments without a skill system, which involves downloading and executing code from the NPM registry.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run a bundled script (scripts/ultra11y.mjs). This execution is restricted by the allowed-tools metadata to a specific path within the skill directory, which reduces the attack surface for arbitrary command execution.

review-a11y