accessibility
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Subprocess Command Execution: The skill invokes external scanning tools using
subprocess.run. This is a central component of its accessibility auditing functionality. - Safe Argument Handling: Commands are executed using argument lists rather than shell strings, which effectively prevents command injection from user-supplied targets.
- External Toolchain Management: The skill utilizes
npxto fetch specific, version-pinned accessibility packages at runtime. This practice ensures that the auditing engine remains consistent and reproducible across different environments. - SSRF Protective Measures: While the scanner is designed to fetch and analyze web content, the skill includes a dedicated runtime guard for its probe harness. This guard restricts probing to loopback addresses (localhost) by default, requiring explicit confirmation for external targets to prevent unintended network access.
Audit Metadata