The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that significantly override default agent behavior to maximize autonomy. Specifically, it commands the agent to execute all steps automatically without waiting for user prompts or review ("CLAUDE EXECUTES ALL STEPS WITHOUT STOPPING", "Do NOT wait for user prompts between steps").
[DYNAMIC_EXECUTION]: The skill instructs the agent to generate and execute several complex Node.js scripts (parallel-audit.js, crawl-audit.js, and multi-tool-scan.js) to perform various auditing tasks. This pattern of script generation and execution increases the risk of unintended behavior or execution of malicious code if the agent's logic is subverted.
[COMMAND_EXECUTION]: The skill constructs shell commands using external inputs such as $TARGET_URL and FULL_VIDEO_URL without providing explicit sanitization or validation logic. This creates a risk of command injection if a malicious URL containing shell metacharacters is provided (e.g., vibium go "$TARGET_URL").
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection because it ingests untrusted data from arbitrary external websites (including HTML text, metadata, and extracted video frames) and uses this data to generate remediation code. A malicious website could include content designed to trick the agent into reporting incorrect audit results or generating malicious code fixes.
Ingestion points: Target website DOM, text content, and visual frames extracted from videos.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the analysis phase.
Capability inventory: Shell command execution (curl, ffmpeg), browser automation (Playwright/Stealth), and file system writes (audit logs and docs).
Sanitization: No explicit sanitization or validation of the fetched site content is mentioned before it is processed by the LLM.
[REMOTE_CODE_EXECUTION]: The skill performs remote script injection by dynamically adding an axe-core script from a CDN (https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.2/axe.min.js) into the DOM of the target website using vibium eval. While the source is a well-known CDN, the pattern of injecting and executing remote code at runtime is a notable security consideration.

a11y-ally