Axe DevTools

Things to consider before installing or running this skill: - Metadata inconsistencies: the registry record claims no required env vars or binaries, but the SKILL.md and scripts require AXE_API_KEY and Docker. Treat the metadata as inaccurate until corrected. - Secret handling: the script passes AXE_API_KEY into a Docker container (dequesystems/axe-mcp-server). That exposes the key to whatever code is in that image. Only proceed if you trust the image owner, or prefer to run a vetted/pinned image digest under your control. - Image provenance: the skill uses the :latest tag. Prefer pulling a specific, signed/digested image (or host it in your private registry) to avoid unexpected updates or supply-chain changes. - Optional endpoint: AXE_SERVER_URL can redirect the tool to a custom server — ensure you control or trust that endpoint. - Minimal code review: the wrapper script is short and readable; it only spawns docker and forwards JSON-RPC. If you plan to use it, review or run it in an isolated environment first. - Billing/credits: SKILL.md notes remediate uses AI credits — confirm costs and data sent to the service. If you want to proceed safely: ask the publisher to update metadata to declare AXE_API_KEY and docker as requirements, request they pin the Docker image (digest), or run the MCP server yourself and set AXE_SERVER_URL to point to your controlled instance. If you cannot verify the image or need to protect secrets, do not provide a production AXE_API_KEY to this skill.