T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run_axe_playwright.js:66- Finding
Unrestricted URL Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
WCAG 2.1 AA Web UI Audit
Security checks for vulnerabilities and agentic risk
Overview
This accessibility-audit skill is coherent and user-directed, with manageable caution around scanning only trusted URLs and installing dependencies carefully.
Install only if you are comfortable with a skill that can run a local browser against URLs you provide and write local audit reports. Use trusted target URLs, avoid attacker-supplied URL lists, avoid running it from privileged internal networks unless intended, and pin/review npm dependencies before following the optional install guidance.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/run_axe_playwright.js:363- Finding
Unpinned Dependency Installation Guidance Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The code clearly relates to web accessibility auditing, so the domain is aligned with the description. It accepts URLs, launches Chromium via Playwright, runs @axe-core/playwright, deduplicates violations, and writes results to outputs/axe-results.json and outputs/axe-summary.md. However, the declared purpose overstates what the implementation does. This script is an automated baseline scanner only, which the code itself explicitly notes in the Markdown output. It does not create a remediation backlog, does not perform manual or comprehensive WCAG 2.1 Level AA evaluation, and does not implement the broader review/conformance activities implied by the description. Therefore this is a description-behavior mismatch due to materially narrower actual functionality, not because of any unrelated or malicious extra capability.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run_axe_playwright.js --url https://example.com
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run_axe_playwright.js --url https://example.com
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md Common impacted components: Menu items, form fields, auto-open popups. ### SC 3.2.2 On Input (Level A) UI meaning: Changing input value must not unexpectedly submit/navigate without warning. Common impacted components: Filters, selects, toggles, settings controls. ### SC 3.2.3 Consistent Navigation (Level AA)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | ID | Flow/Page | Component | WCAG SC (ID • Name • Level) | Severity | Affected Users | Issue Summary | Repro Steps | Expected | Actual | Recommended Fix (Design + Dev) | Verification (Manual + Tool) | Status | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | F-001 | Product -> Cart Drawer | Drawer | 2.1.2 • No Keyboard Trap • A; 2.4.3 • Focus Order • A; 2.4.7 • Focus Visible • AA | Blocker | Keyboard-only, Screen reader, Motor | Focus enters drawer but tabs behind overlay and cannot reliably reach close button. | Open product page, add item, open cart drawer, tab forward repeatedly. | Focus stays in drawer and close control is reachable. | Focus escapes to background and return path is unclear. | Design: preserve visible close action placement and focus ring style. Dev: implement managed focus loop, initial focus on drawer title/close, return focus to trigger on close. | Manual keyboard traversal + axe + screen reader smoke check. | Open | | F-002 | Checkout Payment Step | Form fields and error states | 3.3.1 • Error Identification • A; 3.3.3 • Error Suggestion • AA; 3.3.4 • Error Prevention (Legal, Financial, Data) • AA; 1.4.1 • Use of Color • A | High | Screen reader, Low vision, Cognitive/learning | Card errors are shown as red outlines only with generic message and no correction guidance; no review step before final charge. | Submit invalid card details, observe field errors and final submit behavior. | Errors include field-specific guidance and review/confirm safeguard before charge. | Error text is generic, color-only cue used, and no confirmation step for critical submit. | Design: explicit field-level error copy and review checkpoint pattern. Dev: bind errors via `aria-describedby`, set `aria-invalid`, add pre-submit review confirmation. | Manual form scenario tests + axe checks for ARIA associations. | Open | | F-003 | Product Detail | Add-to-cart toast | 4.1.3 • Status Messages • AA | High | Screen reader, Cognitive/learn ...[truncated 26 chars]
Static analysis
No suspicious patterns detected.