react-component-generator

SUSPICIOUS: the skill is not overtly malicious and shows no credential harvesting or exfiltration path, but its footprint is poorly scoped for its stated purpose. Broad auto-triggering, domain drift beyond React generation, and unrestricted Bash access create disproportionate risk relative to a mostly instructional frontend skill.