The Agent Skills Directory

Command Execution: The skill uses subprocess calls to execute Node.js tools and PowerShell scripts. This is part of the core functionality for running accessibility scans, managing local preview servers, and performing screen-reader automation. These commands use argument lists rather than shell strings and are constrained to intended purposes.
External Dependency Management: The skill fetches the axe-core CLI and other required packages from the public NPM registry. These dependencies are pinned to specific versions, and the use of a dedicated configuration boundary prevents the inheritance of potentially unsafe project-level Node.js settings.
Network Access Controls: Probing of remote targets is governed by an SSRF guard that restricts access to loopback hosts by default. Access to non-loopback hosts requires explicit authorization through a configured allowlist or manual command-line confirmation.
Data Redaction and Privacy: The harness includes a mechanism to redact query strings and common secret parameters (like tokens or signatures) from URLs before recording them. Furthermore, the evidence composition process includes a validation layer that identifies and rejects prohibited content, such as potential credentials or sensitive transcripts.
Input Validation: Configuration files, design intent records, and scan results are validated against strict JSON and YAML schemas. This ensures that all inputs processed by the skill are well-formed and conform to the expected structure, reducing the risk from malformed or malicious data.
Dynamic Module Loading: The skill uses dynamic imports in its JavaScript runner to load specific accessibility probes. These loads are restricted to a pre-defined set of known probe identifiers, preventing the execution of arbitrary local scripts.

accessibility