Security audit

Cuihua A11y Checker

Security checks for vulnerabilities and agentic risk

Overview

This accessibility checker is mostly purpose-aligned, but it overstates its capabilities and has under-scoped local file scanning behavior that users should review before installing.

Review this skill carefully before installing. It appears to be a local checker rather than malware, but do not treat its output as comprehensive WCAG validation, and only run it on a tightly scoped project directory. If using any auto-fix workflow, inspect diffs and test the app before accepting changes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: a11y-checker.js:10
Finding: Files Are Read Before Extension Validation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: a11y-checker.js:137
Finding: Symbolic Links Permit Traversal Outside the Selected Scan Directory
Content: View full analysis
{ const filePath = path.join(dir, file); const stat = fs.statSync(filePath); if (stat.isDirectory() && !file.startsWith('.') && file !== 'node_modules') { this.scanDirectory(filePath); } else if (stat.isFile()) { this.checkFile(filePath); } }); ``` ### Technical Analysis `fs.statSync()` follows symbolic links. As a result, a symbolic link inside the requested scan directory is treated as its target. If the target is a directory, the scanner recursively traverses it; if it is a file, the scanner passes it to `checkFile()`. There is no use of `lstatSync()` to identify links, no canonical-path containment check, no tracking of visited filesystem objects, and no traversal depth or file-count limit. An attacker who controls part of the scanned tree can therefore redirect the checker to locations outside the user-approved root. A link cycle can also cause repeated recursion until the process encounters a filesystem/path error or exhausts resources. Links to large external trees can substantially expand the scan and cause availability degradation. ### Attack Path 1. An attacker creates a symbolic link inside a project that the victim is expected to scan. 2. The link points to a sensitive external file, an external directory, a large filesystem tree, or a directory involved in a link cycle. 3. The victim or AI Agent runs the accessibility checker against the project directory. 4. `fs.statSync()` follows the symbolic link and reports information about its destination. 5. The checker treats the destination as an ordinary file or directory and accesses it outside the selected root. 6. For an external directory, recursive traversal continues without containment, depth, or visited-di ...[truncated 793 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description overstates the implemented functionality. While the code is related to accessibility checking, it is not AI-powered and only performs a limited set of static regex checks on local source files. It does not generate ARIA labels, does not test keyboard navigation, and does not comprehensively validate WCAG compliance. There are no suspicious undeclared behaviors beyond file-system scanning needed for its checker role, but the declared capabilities materially exceed the actual behavior, so this is a mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises 'auto-fix' behavior without warning that source files may be modified, which can lead users to authorize changes they did not expect. In an agentic environment, silent or insufficiently disclosed file modification increases the risk of unintended code changes, broken builds, or unsafe edits being applied to a project.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The usage example states that styles.css was updated and issues were fixed, but it does so without any caution, approval step, or preview of modifications. This normalizes direct file edits by the skill and may cause users to underestimate the impact of running it, especially in repositories where automated edits can introduce regressions or alter compliance-sensitive UI behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.