ClawHub
Back to skill

Security audit

WCAG Accessibility — Testing, Fixing, and Building Accessible Pages

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WCAG accessibility auditing helper that installs and runs expected audit tools without hidden persistence, credential use, or unrelated data access.

Install this only where it is acceptable to add npm-based accessibility tooling and browser dependencies. Run audits against URLs you intend to test, review generated reports before making conformance claims, and do not treat the optional benchmark template as valid submission material without following the benchmark integrity instructions.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to install packages and run local audit tooling via shell-capable commands, but it does not declare any permissions for that capability. This creates a mismatch between what the skill appears allowed to do and what it actually directs an agent to do, which can lead to unintended command execution and package installation in environments that rely on declared permissions for safety review.

Static analysis

No suspicious patterns detected.