100Critical
The skill allows arbitrary command execution via Bash
Behavior Analysis
Description verified — behavior matches claim
Claims to do
CMS Accessibility Scanner: Scan CMS projects for WCAG 2.2 AA violations across views, components, and content type definitions.
Actually does
This skill uses `Read`, `Grep`, `Glob`, and `Bash` to analyze local project files. It identifies the CMS platform (Sitecore, Umbraco, Optimizely) and then scans specific file types like `.tsx`, `.cshtml`, and `.cs` within the project directory. It checks these files against a local `wcag-checklist.md` for WCAG 2.2 AA accessibility violations and generates a structured report.
Skill Info
Nametwofoldtech-dakota/plugin-cms-toolkit/a11y
Registrygithub
Version27fbabdd4251
PURLpkg:github/twofoldtech-dakota/plugin-cms-toolkit@27fbabdd4251?skill=a11y
Stars1
Source
SHA-256edb658fc73c2...
SHA-17efa444afffa...
MD5dc16afaf834d...
TLSHbac1da216c72...
ssdeep96:E8wc3bWsX...
Size5,845 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (1)
AI Agent Traps ↗Unrestricted Bash Command Executioncriticalcommand execution
The skill explicitly allows the `Bash` tool, enabling arbitrary command execution. This poses a severe risk for system compromise, data exfiltration, persistence, and privilege escalation.
100% confidenceline 11
allowed-tools: Read, Grep, Glob, Bash
Broad File System Access for Reconnaissance and Exfiltrationhighreconnaissance
The skill is granted access to `Read`, `Grep`, and `Glob` tools. When combined with `Bash` execution, this allows for extensive file system enumeration and potential exfiltration of sensitive project files (source code, configuration, etc.).
100% confidenceline 35
allowed-tools: Read, Grep, Glob, Bash; Workflow describes scanning `src/**/*.tsx`, `Views/**/*.cshtml`, `Models/**/*.cs`, `Template serialization YAML`
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/twofoldtech-dakota/plugin-cms-toolkit/a11y)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/twofoldtech-dakota/plugin-cms-toolkit/a11y"><img src="https://mondoo.com/ai-agent-security/api/badge/github/twofoldtech-dakota/plugin-cms-toolkit/a11y.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/twofoldtech-dakota/plugin-cms-toolkit/a11y.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow