qa-a11y-compliance

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted UI data (web routes and components) and execute shell commands based on the analysis.
  • Ingestion points: Application routes and UI components provided as input for testing (SKILL.md).
  • Boundary markers: Uses a structured YAML output format (a11y_compliance) to separate tool results.
  • Capability inventory: Employs the Bash tool to run external CLI test runners such as Playwright and pa11y.
  • Sanitization: Relies on external tools (axe-core, Lighthouse) for processing, with no additional sanitization layer defined in the skill instructions.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to perform automated accessibility audits.
  • Evidence: Execution of npx playwright, npx lhci, and npx pa11y-ci to generate audit reports.
  • [EXTERNAL_DOWNLOADS]: The skill references several external Node.js dependencies required for its operation.
  • Evidence: Installation commands for @axe-core/playwright, @lhci/cli, pa11y-ci, and vitest-axe.
  • Context: These are well-known and widely used open-source accessibility testing tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 09:28 AM