The Agent Skills Directory

Command Execution: The skill uses a Python wrapper in scripts/scan.py to execute the axe-core accessibility scanner.
The execution is performed via subprocess.run() using a list of arguments rather than a raw shell string, which is a recommended practice to prevent shell injection vulnerabilities.
The target parameter (a URL or file path) is passed as a positional argument to the external command.
External Code Execution: The script uses the npx utility to fetch and run @axe-core/cli from the npm registry.
This pattern involves downloading and executing code at runtime. Use of the --yes flag allows the command to proceed without interactive confirmation.
@axe-core/cli is a widely recognized and well-known tool for accessibility auditing maintained by established providers.
Dynamic Module Loading: The test suite included with the skill (tests/fuzz_harness.py) utilizes importlib.import_module() to load the scanner logic for testing purposes.
This is a standard pattern for test harnesses and fuzzing targets and does not affect the primary execution path of the skill.
Indirect Input Handling: The skill ingests user-supplied targets (URLs or local files) to perform audits.
This represents an attack surface where a malicious URL could be scanned. The risk is primarily handled by the underlying auditing engine, but it is a consideration when providing the skill with access to local files.

accessibility