qe-visual-accessibility
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from URLs to perform accessibility audits (e.g., WCAG compliance) and visual testing. Ingestion points include the
--urlparameter in CLI commands and theurlfield in programmatic API calls withinSKILL.md. While processing untrusted web content presents a potential attack surface, the skill is scoped to its primary purpose as a quality engineering tool and does not exhibit malicious exploitation or excessive privilege request behavior. - [COMMAND_EXECUTION]: The skill documentation includes examples of executing a local browser utility (
vibium) and Node.js scripts (visual-diff.js) located in a relative path within the skill environment. These executions are necessary for the skill's functionality and are restricted to specific, defined operations for visual comparison.
Audit Metadata