testland/screen-reader-test-author
Use when a feature needs manual screen-reader testing before sign-off: step-by-step scripts for NVDA, JAWS, VoiceOver or TalkBack with keystrokes and expected announcements, WCAG 2.2 checklists per page type, widget keystroke matrices and a guided session with a signed report.
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow uses a user-supplied rendered URL during guided testing sessions to check screen-reader accessibility, allowing an outsider to control content fetched at runtime.
Where we found it
user-supplied rendered URL (web page content)
content-type · 5 sites
The plugin requires a user-supplied rendered URL as a mandatory input and instructs the agent to open it in a browser and interact with its DOM content (reading headings, form fields, announcements), exposing the agent to arbitrary third-party web content that could contain indirect prompt injection.
SKILL.md
171
Required inputs: the component's rendered URL, its
SKILL.md
173
Without a rendered URL the pre-conditions cannot be defined - stop
SKILL.md
180
Header: component name, archetype, URL, date, tester name (blank field),
SKILL.md
200
Pre-conditions block: SR running, browser open to the URL, virtual
SKILL.md
222
**Component:** <name> **Archetype:** <archetype> **URL:** <url>
- Audited
- Security analysis