The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided URLs and processed web content. This data is then analyzed by the AI to generate remediation reports. A malicious website could craft content (e.g., in aria-label or metadata) to influence the AI's behavior during the audit.
Ingestion points: The skill fetches raw HTML and accessibility trees from external URLs via vibium, pa11y, and lighthouse (SKILL.md).
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing the audited content.
Capability inventory: The skill has access to node, curl, ffmpeg, and the vibium browser automation tool (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is passed to the LLM for analysis and report generation.
[EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.
Fetches the axe-core library from Cloudflare's cdnjs CDN for injection into the browser environment.
Downloads video files from audited websites using curl to perform the video accessibility analysis pipeline.
[COMMAND_EXECUTION]: The skill uses several command-line tools to perform its functions.
Executes node, curl, and ffmpeg for script execution, video downloading, and frame extraction.
Utilizes a specialized browser automation tool called vibium to interact with target web pages.
[DYNAMIC_EXECUTION]: The skill generates and executes scripts at runtime.
Dynamically creates and runs Node.js scripts in the /tmp/a11y-work/ directory to manage parallel auditing and site crawling tasks.

a11y-ally