auditing-wcag
Warn
Audited by Snyk on Feb 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill explicitly accepts arbitrary URLs and uses Playwright/WebFetch to navigate, fetch, and analyze page HTML and accessibility trees as part of its required workflow (see "1. Input Acceptance" and "3. Automated Checks" in SKILL.md / SKILL.ja.md and the allowed-tools list), meaning it ingests untrusted public web content that directly informs Pass/Fail decisions and drives automated tool actions.
Audit Metadata