The Agent Skills Directory

[DYNAMIC_EXECUTION]: In scripts/lib/load-ts-constants.mjs, the function loadTsConstants employs vm.runInNewContext to evaluate code extracted from TypeScript palette files. This allow the checker to read project color tables without requiring a full build system or risky require calls, utilizing a sandboxed context (Object.create(null)) with a 1-second timeout.
[DYNAMIC_EXECUTION]: The helper script scripts/check-lib.mjs uses dynamic import() within its importPackage function to load local tooling modules from the repository's .skill-tooling or scripts directories. This is used to resolve pinned dependencies required by the analysis scripts.
[COMMAND_EXECUTION]: The function runNode in scripts/check-lib.mjs uses child_process.spawnSync to execute shell commands. This is primarily used by the self-test suite (scripts/selftest.mjs) to verify that the checkers correctly handle various test fixtures.
[INDIRECT_PROMPT_INJECTION]: The skill implements an analysis engine that ingests and processes source code and configuration files from the target repository, creating a vulnerability surface for indirect influence if malicious content is present in the analyzed codebase.
Ingestion points: Source files (.ts, .tsx, .json) and color tables read by analysis scripts in scripts/check-a11y-code.mjs and scripts/check-contrast.mjs.
Boundary markers: The skill employs character-based masking for comments and literals (via maskCode in scripts/lib/source-scan.mjs) to attempt to isolate executable patterns from natural language data.
Capability inventory: Extensive file system operations (read/write/delete/rename) in scripts/check-lib.mjs, dynamic evaluation in scripts/lib/load-ts-constants.mjs, and subprocess execution in scripts/check-lib.mjs.
Sanitization: Use of Node.js VM isolation for data extraction and selective masking of code components during regex-based scanning.

accessibility-as-code