react-bits

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The agent skill fetches UI components and registry metadata from the public React Bits registry (reactbits.dev), which is a low-risk source since the agent actively fetches specific component files.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to fetch component source code and registry data from reactbits.dev at runtime via scripts and curl commands; however, reactbits.dev is an established open-source project registry owned by David Haz, representing a common/reputable unofficial publisher tier.