Comment by freeqaz

Is this dangerous if the link is able to inject Bash commands as the value of JS_ARG? If so, that's RCE and that's bad.

Is it possible to do this using the HTML5 clipboard functions instead?