qa-a11y-compliance
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted UI data (web routes and components) and execute shell commands based on the analysis.
- Ingestion points: Application routes and UI components provided as input for testing (SKILL.md).
- Boundary markers: Uses a structured YAML output format (
a11y_compliance) to separate tool results. - Capability inventory: Employs the
Bashtool to run external CLI test runners such as Playwright and pa11y. - Sanitization: Relies on external tools (axe-core, Lighthouse) for processing, with no additional sanitization layer defined in the skill instructions.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to perform automated accessibility audits.
- Evidence: Execution of
npx playwright,npx lhci, andnpx pa11y-cito generate audit reports. - [EXTERNAL_DOWNLOADS]: The skill references several external Node.js dependencies required for its operation.
- Evidence: Installation commands for
@axe-core/playwright,@lhci/cli,pa11y-ci, andvitest-axe. - Context: These are well-known and widely used open-source accessibility testing tools.
Audit Metadata