Accessibility Engine

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:19 PM UTC
• Version: 1.0.0

Overview

This is a disclosed accessibility-guidance skill with no hidden execution, persistence, or credential-handling behavior found.

Installers should treat this as a reference skill. If copying its CI or npm examples into a real project, pin package versions and GitHub Actions revisions, commit lockfiles, and run scanners only against sites and repositories they are authorized to test.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Unpinned Third-Party Packages and CI Actions May Execute Untrusted Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 235–256
Vulnerability Type: Supply-chain exposure through unpinned dependencies and dynamically resolved tooling
Risk Level: Medium

Vulnerable Code

markdown

- **axe-core** — industry standard, lowest false positives
  ```bash
  # In Playwright/Cypress
  npm install @axe-core/playwright  # or @axe-core/cypress
  # In CI
  npm install @axe-core/cli
  axe https://your-site.com --tags wcag2a,wcag2aa

• Lighthouse — Chrome DevTools → Lighthouse → Accessibility
• WAVE — wave.webaim.org (visual overlay)
• Pa11y — CLI scanner for CI pipelines

  bash

  pa11y https://your-site.com --standard WCAG2AA
  

CI pipeline integration:

yaml

# GitHub Actions example
a11y-test:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - run: npm ci && npm run build
    - run: npx pa11y-ci --config .pa11yci.json
    - run: npx playwright test --grep @a11y

text

### Technical Analysis

The guidance installs npm packages without exact version constraints and invokes command-line packages through `npx` without requiring a prior, lockfile-controlled installation. If a requested executable is unavailable locally, `npx` may resolve, download, and immediately execute a package from the configured npm registry.

The GitHub Actions example also references `actions/checkout@v4`, a mutable major-version tag, rather than an audited full commit SHA. Although this is a common configuration, it does not provide immutable provenance.

Package installation and GitHub Actions both execute upstream-controlled code. Consequently, compromise of a referenced package, its transitive dependencies, a registry account, or a mutable action reference could turn these otherwise legitimate instructions into a supply-chain execution channel. The audit did not identify an intentionally malicious or typosquatted dependency; the risk arises from unsafe version resolution and execution practice
...[truncated 1555 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin npm packages to reviewed exact versions rather than unconstrained latest releases:

   bash

   npm install --save-dev @axe-core/playwright@<reviewed-version>
   npm install --save-dev @axe-core/cli@<reviewed-version>
   npm install --save-dev pa11y-ci@<reviewed-version>
   npm install --save-dev @playwright/test@<reviewed-version>
   

2. Commit and review the package lockfile. In CI, retain npm ci so dependency resolution follows the lockfile and fails when it is inconsistent with package.json.

3. Install all required CLI tools explicitly, then prevent npx from downloading missing packages at execution time:

   bash

   npx --no-install pa11y-ci --config .pa11yci.json
   npx --no-install playwright test --grep @a11y
   

4. Pin GitHub Actions to audited full commit SHAs, optionally retaining the release tag in a comment for maintainability:

   yaml

   - uses: actions/checkout@<audited-full-commit-sha> # v4.x.x
   

5. Enable dependency update and vulnerability-monitoring automation. Require review of lockfile changes, package provenance, lifecycle scripts, maintainers, and transitive dependency changes before merging updates.

6. Harden CI with explicit least-privilege permissions, avoid exposing secrets to workflows triggered by untrusted forks, and use isolated ephemeral runners where feasible.

7. Consider disabling unnecessary npm lifecycle scripts during installation and allowing them only for dependencies that have been reviewed and require them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

Fix 1: Missing alt text

html

<!-- ❌ -->
<img src="chart.png">
<img src="decorative-swoosh.svg">

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.