web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The initialization and bundling scripts install various standard development packages from the public NPM registry. Key packages include Vite, Tailwind CSS, Parcel, and Radix UI components (
scripts/init-artifact.sh,scripts/bundle-artifact.sh). - [COMMAND_EXECUTION]: The initialization script (
scripts/init-artifact.sh) installs thepnpmpackage manager globally usingnpm install -gif the command is not found. - [PROMPT_INJECTION]: The skill facilitates the creation of web-based artifacts that may process untrusted data at runtime.
- Ingestion points: The generated React application is intended to render content within an AI agent's artifact view (
SKILL.md). - Boundary markers: The scripts do not automatically include delimiters or specific instructions to ignore embedded prompts in the generated boilerplate.
- Capability inventory: The skill uses shell scripts to perform file system operations, install packages, and execute build tools (
scripts/init-artifact.sh,scripts/bundle-artifact.sh). - Sanitization: No explicit content sanitization or validation logic is implemented in the project setup scripts.
Audit Metadata