web-accessibility

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several shell command patterns used for auditing local source code for accessibility regressions and violations. These include grep commands in SKILL.md, FORMS.md, MOTION-AND-ZOOM.md, SCREEN-READERS.md, and SEMANTICS-AND-ARIA.md to identify problematic patterns like hardcoded tab indices, disabled submit buttons, and missing focus indicators. Additionally, REVIEW.md contains a complex git diff pipeline for detecting accessibility signals removed during code changes.
  • [DYNAMIC_EXECUTION]: In MOTION-AND-ZOOM.md, the skill instructs the agent to execute a Python script (python3 <color-system>/scripts/contrast.py) to verify color contrast ratios. This script is part of the broader ecosystem of skills from the same author.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted UI source code (HTML, React, CSS) which serves as an ingestion point for external data.
  • Ingestion points: UI source code files located in src/ and public/ directories.
  • Boundary markers: None explicitly defined in the instructions to delimit ingested code from agent instructions.
  • Capability inventory: The skill utilizes grep, git, and python3 for auditing tasks, which involves spawning subprocesses to interact with the file system.
  • Sanitization: No explicit sanitization or filtering of the ingested source code is described beyond the use of standard search utilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 03:18 PM