The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass the agent's standard interactive behavior and execute all actions autonomously without waiting for user approval. Phrases like "CLAUDE EXECUTES ALL STEPS WITHOUT STOPPING" and "Do NOT wait for user prompts between steps" are used to override default safety and oversight protocols.
[DYNAMIC_EXECUTION]: The skill generates multiple JavaScript files (e.g., multi-tool-scan.js, parallel-audit.js, crawl-audit.js) in the /tmp directory and executes them using node. This pattern of on-the-fly code generation and execution poses a risk as the logic is not statically fixed.
[EXTERNAL_DOWNLOADS]: The skill performs runtime installation of several Node.js packages using npm install (playwright-extra, pa11y, lighthouse, etc.) and uses curl to download video files from external, user-provided URLs to the local filesystem for processing with ffmpeg.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from arbitrary URLs, including HTML structures and video frames (via computer vision).
Ingestion points: Content from TARGET_URL, video files downloaded via curl, and frames extracted by ffmpeg.
Boundary markers: None identified; instructions do not include delimiters or warnings to ignore malicious content embedded in the target data.
Capability inventory: Full shell access (bash), package management (npm), script execution (node), file system write access (fs.writeFileSync), and network capabilities (curl, browser automation).
Sanitization: No evidence of sanitization or validation of the external content before it is processed by the LLM for remediation analysis.

qe-a11y-ally