The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages the installation of necessary Node.js dependencies (axe-core, puppeteer, and http-server) and the download of a compatible Chromium browser. These operations are required for the skill's primary function and use pinned versions from established registries.
[COMMAND_EXECUTION]: The skill coordinates its audit pipeline by executing its own helper scripts via node and managing dependencies through the npm CLI. It uses argument arrays rather than shell interpolation for these operations to prevent injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: Since the skill processes external web content, it implements data sanitization by escaping target-derived fields in its generated Markdown reports and issue plans. This ensures that HTML snippets or accessibility findings are not interpreted as commands by the AI agent.
[DATA_EXFILTRATION]: The skill performs legitimate network requests to discover sitemaps and audit web pages. It includes security measures like origin policy enforcement for sitemaps and workspace-relative path validation to ensure network and file operations are confined to the project scope.

a11y-audit