The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill mandates the use of development-only tools such as react-grab, react-doctor, and react-scan for React projects. These are installed via npx, which fetches code from the npm registry. These tools are part of a legitimate ecosystem (Million.dev) intended to improve developer experience and AI-agent interactions.
[COMMAND_EXECUTION]: A Python script for performance auditing (scripts/perfection/lighthouse-audit.py) utilizes subprocess.run to call npm for dependency management and node to run a Lighthouse audit. These operations use array-based arguments and do not invoke a shell, following secure coding practices for subprocess management.
[REMOTE_CODE_EXECUTION]: Documentation and code comments within the skill suggest installing uv, a Python package manager, via a curl | sh command from astral.sh. While curl | sh is a high-risk pattern, Astral is a well-known and trusted provider of development tooling. The skill also uses npx to run tool installers that may modify the agent's local environment by adding new capabilities, which is a disclosed feature of the react-doctor tool.
[SAFE]: The skill operates as a high-level router and reference library for frontend engineering. All automated steps and instructions are focused on development productivity, performance optimization (Lighthouse 100 targets), and design system compliance. There are no indications of unauthorized data access, obfuscation, or malicious intent.

frontend