The Agent Skills Directory

[PROMPT_INJECTION]: The AccessibilityReportGenerator in resources/implementation-playbook.md generates an HTML report by directly interpolating data from auditResults into an HTML string using template literals. This creates a surface for indirect prompt injection (XSS).
Ingestion points: Data enters the system via the url parameter in runFullAudit, which is then processed by axe-core. Findings are stored in the auditResults object (specifically v.help and v.description).
Boundary markers: No delimiters or instructions to ignore embedded code are present in the report generation template.
Capability inventory: The skill provides code to launch a headless browser using puppeteer and execute shell commands in CI/CD environments as seen in resources/implementation-playbook.md.
Sanitization: The generateHTMLReport method lacks any HTML escaping or sanitization of the values injected from the auditResults object.
[EXTERNAL_DOWNLOADS]: The skill provides configuration for GitHub Actions in resources/implementation-playbook.md that references official repositories from the actions organization, such as actions/checkout, actions/setup-node, and actions/upload-artifact. These are recognized as trusted sources. It also references standard testing packages from the npm registry.
[COMMAND_EXECUTION]: The provided code samples in resources/implementation-playbook.md include calls to puppeteer.launch() to initiate browser sessions and various npm lifecycle scripts for environment setup and testing. These operations are aligned with the skill's primary objective of conducting digital accessibility audits.

accessibility-compliance-accessibility-audit