The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute a package directly from the author's GitHub repository (mgifford/accessibility-skills) at runtime.
[COMMAND_EXECUTION]: The skill executes a shell command (npx) that incorporates a user-provided URL parameter. This creates a potential command injection surface if the platform does not properly sanitize or quote the input variable.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from live websites (including page titles and structural metadata) which the agent is then instructed to evaluate.
Ingestion points: External website content is retrieved and parsed in scripts/cli-inspect.mjs (and the remote equivalent).
Boundary markers: The instructions lack explicit delimiters or safety warnings to separate the external site data from the agent's core instructions.
Capability inventory: The agent is directed to evaluate the resulting JSON (including axe.violations and accessibilityTree), which could contain instructions designed to influence the agent's behavior.
Sanitization: The skill does not perform sanitization or filtering on the retrieved website content before processing it.

cli-audit