The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly directs the agent to execute npx -y grab@latest. The package 'grab' on the npm registry is an unrelated legacy project and does not correspond to the 'react-grab' tool described in the skill metadata and documentation. This constitutes a typosquatting attack designed to execute arbitrary code from an unintended source.
[REMOTE_CODE_EXECUTION]: The inclusion of the -y flag in all recommended commands (e.g., npx -y grab@latest init) intentionally silences safety prompts that would normally warn a user before installing and running an unknown package.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of external scripts from the npm registry and unpkg CDN.
Evidence: src="//unpkg.com/react-grab/dist/index.global.js" is injected into framework configuration files.
[COMMAND_EXECUTION]: The skill uses shell scripts (scripts/install.sh, scripts/add-agent.sh) to perform environment setup, which in turn execute further commands and package managers without sufficient validation of the downloaded binaries.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by design, as it ingests untrusted data from live browser environments.
Ingestion points: The get_element_context tool and clipboard workflow capture HTML snippets, component names, and stack traces from external websites.
Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded commands within the captured context.
Capability inventory: The agent possesses Bash, Write, Edit, and WebFetch capabilities, which could be abused if the agent is subverted by malicious content in the browser UI.
Sanitization: Absent; the skill does not mandate filtering or escaping of the HTML or metadata captured from the browser.

react-grab