The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash scripts to automate the development lifecycle. scripts/init-artifact.sh initializes a React project using pnpm create vite, and scripts/bundle-artifact.sh executes parcel build to generate the final artifact. These scripts also use sed and node to modify configuration files.
[EXTERNAL_DOWNLOADS]: The initialization and bundling scripts download a large number of dependencies from the official NPM registry. This includes frameworks (React, Vite), styling tools (Tailwind CSS, PostCSS), and UI components (Radix UI, shadcn/ui).
[PRIVILEGE_ESCALATION]: The scripts/init-artifact.sh script attempts to install pnpm globally using npm install -g pnpm if it is not detected on the system. Global installations typically require elevated (root/sudo) privileges.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing pipeline for code generated or modified by the AI agent based on user instructions.
Ingestion points: The agent writes and edits React source files (e.g., src/App.tsx) within the initialized project directory.
Boundary markers: No explicit boundary markers or "ignore" instructions are used when the scripts process the source files.
Capability inventory: The bundling script uses parcel and html-inline to process and inline all project assets into a single HTML file.
Sanitization: There is no sanitization or validation of the code before the bundling process occurs. Maliciously crafted React code could potentially execute unintended logic in the user's browser when the artifact is rendered.

artifacts-builder