artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The initialization script (init-artifact.sh) interpolates the project name argument into shell commands such as pnpm create and sed without escaping, which could be exploited if a malicious project name is supplied. The scripts also manage file system operations and project configuration.
- [EXTERNAL_DOWNLOADS]: The skill uses pnpm and npm to download and install a wide range of standard frontend libraries and build tools from the official NPM registry during project initialization and bundling.
- [REMOTE_CODE_EXECUTION]: The skill installs and runs external build tools (Vite, Parcel) and development dependencies as part of its core artifact creation and bundling functionality.
Audit Metadata