The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx -y to download and run @accesslint/chrome and @accesslint/cli from the public npm registry at runtime.
[REMOTE_CODE_EXECUTION]: By specifying the @latest tag for npm packages, the skill executes code that is not version-pinned. This introduces a supply chain risk where the behavior of the skill could change maliciously if the external package is compromised.
[COMMAND_EXECUTION]: User-provided input (the URL) is interpolated directly into a shell command in SKILL.md. This creates a command injection surface if the agent does not properly sanitize the URL argument before execution.
[COMMAND_EXECUTION]: The skill employs node -e to dynamically evaluate a script that processes JSON input from a pipe to extract port information, which is a sensitive execution pattern.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the skill's primary purpose is auditing, it accepts a user-defined URL and passes it to an external CLI tool. This is a standard functional pattern for this utility but involves processing untrusted external inputs.

accesslint-scan