The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y rea-agents to download and execute the rea-agents package from the NPM registry. This command is used for diagnostic ('doctor') and installation ('setup') purposes. While this is a vendor-owned resource, it involves the execution of remote code on the local system.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install external binary analysis tools, specifically referencing a Mac application called 'Hopper'.
[COMMAND_EXECUTION]: The agent is instructed to execute shell commands using npx and interact with local installers or binary analysis engines.
[PROMPT_INJECTION]: The skill processes untrusted external data, creating an indirect prompt injection surface.
Ingestion points: The skill reads data from web pages (inspect_web_page), application binaries (open_binary), and various archives including Electron ASAR and DMG files (inventory_artifact).
Boundary markers: Instructions require explicit user approval for loopback CDP endpoints, filesystem root authority for Electron inspection, and specific artifact extraction occurrence IDs.
Capability inventory: The skill can execute remote code via npx and perform file system operations via extract_artifact and open_binary across different scripts.
Sanitization: The instructions specify that sensitive data (cookies, credentials, authorization headers) must be redacted during browser inspection and that page-declared tools (WebMCP) must be treated as untrusted and never invoked.

rea-analysis