# Review A11Y > Review changed frontend code for WCAG 2.2 AA accessibility with findings, fixes, and a verdict. - Skill: `maxgfr/review-a11y` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add maxgfr/review-a11y` - Raw SKILL.md: https://api.skillmd.com/api/skills/maxgfr/review-a11y/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Web & Frontend - License: MIT - Author: maxgfr (https://skillmd.com/u/maxgfr) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/maxgfr/review-a11y --- # review-a11y — accessibility review of changed code The review counterpart of the `ultra11y` skill: where `ultra11y` produces full audits and compliance deliverables, **this skill reviews exactly the code under change** — a diff, a branch, a PR — and reports like a code reviewer. Same division of labour: the deterministic, install-free engine bundled with this skill does the *mechanical* work (machine-checkable WCAG 2.2 AA non-conformities, each tied to a success criterion, cited `file:line`), and **the AI agent** *adjudicates the judgment* — refute false positives, decide alt relevance/link purpose/focus logic statically from the code, and route what needs a rendered DOM to `scan`. A human is at most optional oversight. **Engine resolution:** every command below is `node scripts/ultra11y.mjs …` where `scripts/ultra11y.mjs` lives **next to this SKILL.md** (the engine ships inside the skill; no install, no key). Run it with the reviewed project as the working directory. In the ultra11y repository itself, the repo root's `scripts/ultra11y.mjs` is the same file. On Claude Code that path is `${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs`; on Codex and OpenCode it is the skill directory the plugin installed. If neither resolves — a harness with no skill system — `npx -y ultra11y ` is the same engine. Per-harness deltas: `references/harnesses.md` in the `ultra11y` skill. > **Core rules** (shared with `ultra11y`): > 1. **Never invent a non-conformity**: report only what the engine found or what you can > see and cite in the code under review. > 2. **Review the change, not the world**: findings outside the reviewed scope are noted in > one line at most ("pre-existing, out of scope"), never mixed into the verdict. > 3. **Residual is explicit, never silently conforming**: the *rendering* criteria (contrast, > focus visibility, zoom/reflow, content-on-hover) are named as residual risks for the changed > components — never asserted from source, resolved in the rendered page (`scan`). The > *judgment* criteria (alt relevance, link purpose, reading order) the AI agent adjudicates > from the code itself, recording a reason — no status without a justified verdict. > 4. **Language**: write the review in the conversation's language, but technical tokens > stay in English even in French prose — `aria-live` stays `aria-live` (never > « région live »), same for `tabindex`, `alt`, `role="alert"`, landmark role names. ## 1. Scope — review what changed Pick the FIRST that applies (ask only when genuinely ambiguous): ``` node scripts/ultra11y.mjs audit --jsx --json # explicit files node scripts/ultra11y.mjs audit --staged --graph --json # staged snapshot (pre-commit review) node scripts/ultra11y.mjs audit --changed --graph --json # working diff node scripts/ultra11y.mjs audit --since origin/main --graph --json # the whole branch (PR review) — use the repo's default branch ``` - Always pass `--graph` for JSX/TSX (real AST + cross-file rules: icon-only component used without a name, anchor target defined in another file…); it also suppresses a class of single-file false positives. - Pass `--lang` matching the conversation so the engine's message/remediation strings are in the review's language (unset, the CLI auto-detects — a fallback, not a substitute). - Whole-repo review is an **audit**, not a review — offer the `ultra11y` skill instead. - Test/story markup (`*.test.*`, `*.stories.*`, `__tests__/`) is excluded by default; name such a file explicitly to include it, or pass `--no-default-excludes`. ## 2. Judge — the engine's findings are candidates, not verdicts For each finding (`--json` gives `criteria`, `severity`, `file:line`, `message`, `remediation`): - **Confirm the occurrence**: open the cited line; the offending element must really be there in the change under review. - **`preliminary: true` findings** (`.vue`/`.svelte`/`.astro` source, library components): the template parser cannot see slots, conditionals or provide/inject wiring. Confirm against the rendered DOM if captures exist (`.ultra11y/captures`, from the `ultra11y` skill's `render --setup` harvester), otherwise report them as **provisional** with that caveat — or refute them with evidence from the code. - **Library-rendered JSX (DSFR, MUI…)**: a clean source review can still ship broken HTML (false negatives) — say so explicitly when the change touches such components, and recommend a rendered-DOM check (`scan`, or the `ultra11y` capture pipeline). - **The judgment criteria are the AI agent's to adjudicate**: alt text relevance, link purpose in context, visible label vs accessible name, keyboard/focus logic of the changed component (read the full component source, not just the flagged line), recording a reason for each call. - Refuting a finding requires **cited evidence** (the code that disproves it); silently dropping findings is forbidden. ## 3. Report — a review, not a compliance document Render in the conversation's language (Core rule 4), grouped by severity: ``` ## Accessibility review — ### 🔴 Blocking - `src/components/Form.tsx:42` — **3.3.2 Labels or Instructions** — input has no label and placeholder is its only hint → associate a real