The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to verify the existence of a 'tokens' directory located at ${CLAUDE_SKILL_DIR}/../../../tokens. Probing for credential storage or tokens is a high-risk behavior that is unrelated to the skill's stated purpose of performing accessibility audits.
[COMMAND_EXECUTION]: The skill utilizes directory traversal sequences (../../../) to execute shell commands (node, python3, ls) against files and directories located far outside the skill's own sandbox.
[DYNAMIC_EXECUTION]: The skill depends on the execution of external scripts (measure_render.mjs, verify_states.mjs, contrast.py) that are not included within the skill package but are located in the broader environment, which could lead to unverified code execution.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by processing external UI and HTML files through system scripts. 1. Ingestion points: <file> argument in SKILL.md. 2. Boundary markers: None. 3. Capability inventory: Execution of node and python3 scripts in SKILL.md. 4. Sanitization: No sanitization of external file content is performed before processing.

a11y-audit