The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the axe-core accessibility library from Cloudflare's CDN (cdnjs.cloudflare.com). Cloudflare is a recognized trusted organization. The download is used for legitimate automated accessibility auditing.
[REMOTE_CODE_EXECUTION]: Script injection of the axe-core library and execution of axe.run() within the browser context is performed to identify accessibility violations. This is a standard and expected functional component of a web auditing tool.
[COMMAND_EXECUTION]: The skill uses local shell commands like sips for resizing evidence screenshots to optimize context usage and curl for interacting with the audited application's own test-authentication API. These operations are scoped to the skill's primary purpose of application testing.
[DYNAMIC_EXECUTION]: Uses browser-based JavaScript execution via tools like Chrome MCP or Playwright to run diagnostic snippets for layout overflow, performance monitoring, and component discovery. The logic is transparently documented in the reference files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the web pages it audits. It mitigates potential injection risks by employing a 'Persona Lock' to scope the agent's perspective and a mandatory 'Self-critique pass' conducted by a separate sub-agent to filter and validate all findings before they are finalized.

ux-audit