508-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 508-audit (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You run a federal-grade accessibility audit and produce the deliverable trio agencies require (VPAT 2.5 + ACR + remediation plan). Federal procurement is increasingly contingent on these — failure to provide credible 508 documentation eliminates vendors from competition.
Standards landscape (2026):
============================================================ === PRE-FLIGHT === ============================================================
Verify:
Recovery:
============================================================ === PHASE 1: AUTOMATED SCAN === ============================================================
Run axe-core (@axe-core/cli or via Playwright @axe-core/playwright) against every priority URL:
npx @axe-core/cli --rules wcag22aa,best-practice https://example.gov \
--save axe-report.json \
--tags wcag2a,wcag2aa,wcag21a,wcag21aa,wcag22a,wcag22aaAlso run Lighthouse accessibility category for each URL. Persist both as automated_findings.json.
Caveats explicit to the user:
VALIDATION: Automated scan completes on every priority URL with no exit-1. Findings deduplicated.
============================================================ === PHASE 2: KEYBOARD AUDIT === ============================================================
Manual keyboard walkthrough. For each priority page:
Generate keyboard_findings.md with per-page checklist and violations.
VALIDATION: Every interactive element tested. Findings reference specific WCAG SC.
============================================================ === PHASE 3: SCREEN READER AUDIT === ============================================================
Test priority pages with NVDA (Windows + Chrome/Firefox) and VoiceOver (Mac/iOS). Report per page:
<header>, <nav>, <main>, <aside>, <footer>) present.<label for> or aria-labelledby.alt="" or role="presentation".<title> + aria-labelledby or hidden via aria-hidden.<th> + scope for data tables; layout tables avoided.aria-live="polite" or "assertive").Generate sr_findings.md per page with screen-reader-specific issues.
VALIDATION: Findings cite specific SC + reproducer steps.
============================================================ === PHASE 4: COGNITIVE / READABILITY AUDIT === ============================================================
WCAG 2.2 added several cognitive-load SC:
autocomplete="email", autocomplete="given-name").VALIDATION: Each page has cognitive checklist run with findings.
============================================================ === PHASE 5: VPAT 2.5 GENERATION === ============================================================
Generate vpat.docx (or vpat.md if user prefers) following the VPAT® 2.5 Rev 508 template from ITI / Section508.gov:
Sections required:
Per criterion remarks must be specific. "Supports" without explanation is suspect to procurement officers.
VALIDATION: VPAT covers ALL applicable WCAG 2.0 A/AA criteria + all 508 chapters. Every "Partially Supports" / "Does Not Support" has a remarks explanation.
============================================================ === PHASE 6: ACCESSIBILITY CONFORMANCE REPORT (ACR) === ============================================================
The ACR is the VPAT-formatted document signed and dated, typically delivered with the procurement response. Generate as acr.pdf (via pandoc + wkhtmltopdf or weasyprint) with:
VALIDATION: ACR is a single PDF, signed, dated.
============================================================ === PHASE 7: REMEDIATION PLAN === ============================================================
Generate remediation_plan.md with findings ranked:
| Priority | Finding | WCAG SC | Sample URL | Estimated effort | Suggested fix |
|---|---|---|---|---|---|
| P0 | Keyboard trap in date picker | 2.1.2 | /apply | 4 hr | Use <input type="date"> or trap-aware Floating UI |
| P0 | No skip link | 2.4.1 | All pages | 1 hr | Add <a href="#main" class="skip-link">Skip to main</a> in layout |
| P1 | Insufficient color contrast on link hover | 1.4.3 | All pages | 2 hr | Update --color-link-hover to ≥ 4.5:1 |
| P2 | Missing lang attribute | 3.1.1 | /es/\* | 1 hr | Set <html lang="es"> for Spanish pages |
P0 = WCAG fail that prevents access entirely. P1 = fail that hinders. P2 = polish.
Output also as JIRA / GitHub Issues import CSV.
VALIDATION: Every finding from phases 1-4 appears in the plan. P0 items have effort estimates.
============================================================ === SELF-REVIEW === ============================================================
Score 1–5:
Common gap: VPAT with vague "Supports" remarks. Each must reference specific testing evidence.
============================================================ === LEARNINGS CAPTURE === ============================================================
Append to ~/.claude/skills/508-audit/LEARNINGS.md:
============================================================ === STRICT RULES === ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.