web-accessibility
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several shell command patterns used for auditing local source code for accessibility regressions and violations. These include
grepcommands inSKILL.md,FORMS.md,MOTION-AND-ZOOM.md,SCREEN-READERS.md, andSEMANTICS-AND-ARIA.mdto identify problematic patterns like hardcoded tab indices, disabled submit buttons, and missing focus indicators. Additionally,REVIEW.mdcontains a complexgit diffpipeline for detecting accessibility signals removed during code changes. - [DYNAMIC_EXECUTION]: In
MOTION-AND-ZOOM.md, the skill instructs the agent to execute a Python script (python3 <color-system>/scripts/contrast.py) to verify color contrast ratios. This script is part of the broader ecosystem of skills from the same author. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted UI source code (HTML, React, CSS) which serves as an ingestion point for external data.
- Ingestion points: UI source code files located in
src/andpublic/directories. - Boundary markers: None explicitly defined in the instructions to delimit ingested code from agent instructions.
- Capability inventory: The skill utilizes
grep,git, andpython3for auditing tasks, which involves spawning subprocesses to interact with the file system. - Sanitization: No explicit sanitization or filtering of the ingested source code is described beyond the use of standard search utilities.
Audit Metadata