web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The script
scripts/init-artifact.shincludes a routine to install thepnpmpackage manager globally usingnpm install -g pnpmif it is not already present. This behavior modifies the global system environment and requires elevated permissions. - [DYNAMIC_EXECUTION]: The skill's scripts programmatically generate and modify project configuration and source files during the initialization and build processes.
- Evidence: In
scripts/init-artifact.sh, the skill usescatto createpostcss.config.js,tailwind.config.js,src/index.css, andcomponents.jsonfrom heredoc templates. - Evidence: In
scripts/init-artifact.sh,node -eis used to programmatically parse, modify, and rewritetsconfig.jsonandtsconfig.app.jsonto inject path aliases. - Evidence: In
scripts/bundle-artifact.sh, the skill creates a.parcelrcconfiguration file at runtime before initiating the build process. - [COMMAND_EXECUTION]: The skill relies on complex shell scripts to orchestrate the development environment, involving multiple subprocess calls.
- Evidence:
scripts/init-artifact.shexecutespnpm create,pnpm install,sedfor template cleaning, andtarto extract a pre-packaged component library (shadcn-components.tar.gz). - Evidence:
scripts/bundle-artifact.shexecutesparcel buildandhtml-inlineto process and bundle the application into a single file.
Audit Metadata