The Agent Skills Directory

[SAFE]: The skill includes a shell script (scripts/analyze.sh) that performs basic static analysis using grep to identify React patterns and component counts. The script uses safe practices like quoting variables to prevent shell injection from file paths.
[SAFE]: The documentation references official React resources (react.dev) and well-known community sites (netlify.app). All references to external code repositories point to the author's official GitHub organization (wojons/skills), which is consistent with the skill's ownership.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to analyze external source code files, it technically ingests untrusted data. However, since the analysis logic is limited to simple text matching and does not involve executing the code or complex prompt interpolation, the risk of the agent being misled by instructions hidden in code comments is negligible.
[SAFE]: No obfuscation, persistence mechanisms, or privilege escalation patterns were detected in the skill's instructions or scripts.

react-review