Skills
skills/eigent-ai/agent-skills/web-artifacts-builder/Gen Agent Trust Hub

web-artifacts-builder

Warn

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/init-artifact.sh is vulnerable to command injection through the project name argument. The variable $PROJECT_NAME (which takes the value of the first script argument) is used inside double quotes in commands such as pnpm create vite "$PROJECT_NAME". In a shell environment, command substitution (using backticks or $()) is still active within double quotes, potentially allowing arbitrary code execution if a malicious project name is provided.
  • [EXTERNAL_DOWNLOADS]: The scripts/init-artifact.sh and scripts/bundle-artifact.sh scripts perform numerous installations of Node.js packages from the npm registry at runtime, including a global installation of pnpm. This creates a heavy dependency on external package repositories.
  • [EXTERNAL_DOWNLOADS]: The scripts/init-artifact.sh script extracts an opaque local tarball shadcn-components.tar.gz. Since the content of this archive is not provided for analysis, it represents an unverifiable dependency that is integrated directly into the generated project's source code.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 8, 2026, 10:20 AM
Security Audit — agent-trust-hub — web-artifacts-builder