菜单
WCAG 2.2 Level AA accessibility scanning methodology — three-engine architecture, SARIF output, severity mapping, and compliance thresholds
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
FinOps scanning methodology — 4-tool architecture, PSRule/Checkov/Cloud Custodian/Infracost, SARIF output, cost optimization patterns, and CI/CD integration
Domain repository scaffolding patterns — demo-app and workshop repo templates, bootstrap scripts, screenshot automation, PBIP schemas, and CI/CD pipeline generation
Agent configuration file security scanning — 4-engine architecture, OWASP LLM Top 10 mapping, Unicode steganography detection, MCP validation, SARIF output
Code quality scanning methodology — 4-tool architecture, MegaLinter orchestration, SARIF output, coverage and complexity mapping, and CI/CD integration
| name | a11y-scan |
| description | WCAG 2.2 Level AA accessibility scanning methodology — three-engine architecture, SARIF output, severity mapping, and compliance thresholds |
Domain knowledge for WCAG 2.2 Level AA accessibility scanning. Agents load this skill to understand the scanner architecture, output format, severity classification, and compliance thresholds.
The accessibility scanner uses a three-engine architecture for maximum coverage:
| Engine | Role | Technology |
|---|---|---|
| axe-core (primary) | Runs axe-core directly on the page via @axe-core/playwright | axe-core v4.10+, Playwright |
| IBM Equal Access (secondary) | Runs IBM accessibility-checker ACE engine in an isolated Playwright page | accessibility-checker |
| Custom Playwright checks (5 checks) | DOM inspection for patterns not covered by engines | Playwright page.evaluate() |
waitUntil: 'networkidle'.['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa', 'wcag22aa', 'best-practice'].| Check ID | What It Detects |
|---|---|
ambiguous-link-text | Links using generic text like "click here" or "read more" |
aria-current-page | Navigation items missing aria-current="page" on active link |
emphasis-strong-semantics | <b> / <i> used instead of semantic <strong> / <em> |
discount-price-accessibility | Strikethrough prices lacking aria-label or visually hidden text |
sticky-element-overlap | Sticky/fixed elements that may obscure focused content (WCAG 2.4.11) |
The scanner produces SARIF v2.1.0 compliant output.
| Field | Value |
|---|---|
$schema | https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json |
version | 2.1.0 |
tool.driver.name | accessibility-scanner |
automationDetails.id | accessibility-scan/<url> |
partialFingerprints | Hash of ruleId:target for deduplication |
results[].ruleId | Mapped from axe-core violation.id |
results[].level | Mapped from impact (see severity mapping) |
help.markdown | Rule description, WCAG mapping, remediation, and learn-more links |
properties.tags | Includes accessibility plus WCAG SC tags |
| axe-core Impact | SARIF Level | security-severity | Weighted Score |
|---|---|---|---|
| critical | error | 9.0 | 10 |
| serious | error | 7.0 | 7 |
| moderate | warning | 4.0 | 3 |
| minor | note | 1.0 | 1 |
help.markdown — Embeds rule description, WCAG mapping, remediation, and learn-more links (GitHub does not render helpUri; URLs must be embedded in markdown).properties.precision — very-high for axe-core, high for IBM Equal Access.properties.tags — Includes accessibility tag plus WCAG SC tags for GitHub filtering.partialFingerprints — Hash of ruleId:target for deduplication across runs.automationDetails.id — Category prefix for multi-tool scenarios.wcag2a, wcag2aa, wcag21a, wcag21aa, wcag22aa, best-practice
| SC | Title | Automatable |
|---|---|---|
| 2.4.11 | Focus Not Obscured (Minimum) | Partially — custom check for position: sticky/fixed |
| 2.5.7 | Dragging Movements | Manual review required |
| 2.5.8 | Target Size (Minimum) | Partially — check min 24×24 CSS pixels |
| 3.2.6 | Consistent Help | Manual review required |
| 3.3.7 | Redundant Entry | Manual review required |
| 3.3.8 | Accessible Authentication (Minimum) | Manual review required |
| Metric | Default Threshold |
|---|---|
| Minimum score | 70 (0–100 scale) |
| Critical violations | 0 |
| Serious violations | 0 |
| Moderate violations | 10 |
| Minor violations | 999 (no limit) |
Weighted score formula: 100 - Σ(impact_weight × violation_count) clamped to 0–100.
Grade scale: A (90–100), B (80–89), C (70–79), D (60–69), F (0–59).
POUR principle breakdown assigns each finding to one of: Perceivable, Operable, Understandable, or Robust.
These violations appear most frequently across scans:
| # | Rule ID | WCAG SC | Category |
|---|---|---|---|
| 1 | color-contrast | 1.4.3 | Perceivable |
| 2 | image-alt | 1.1.1 | Perceivable |
| 3 | link-name | 2.4.4 | Operable |
| 4 | button-name | 4.1.2 | Robust |
| 5 | label | 1.3.1 | Perceivable |
| 6 | html-has-lang | 3.1.1 | Understandable |
| 7 | heading-order | 1.3.1 | Perceivable |
| 8 | empty-heading | 2.4.6 | Operable |
| 9 | document-title | 2.4.2 | Operable |
| 10 | aria-hidden-focus | 4.1.2 | Robust |
- uses: devopsabcs-engineering/accessibility-scan-demo-app@main
with:
url: https://example.com
mode: single
threshold: 70
output-format: sarif
output-directory: ./a11y-results
- uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: ./a11y-results
category: accessibility-scan
- script: npx a11y-scan scan --url "$(SCAN_URL)" --threshold 80 --format junit --output results.xml
- task: PublishTestResults@2
inputs:
testResultsFormat: 'JUnit'
failTaskOnFailedTests: true
Ontario's AODA legally requires WCAG 2.0 Level AA. Conforming to WCAG 2.2 Level AA automatically satisfies AODA requirements and anticipates future policy updates.