web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell scripts to manage the project lifecycle.
  • scripts/init-artifact.sh uses pnpm create vite to scaffold the project and sed to clean up the template.
  • The script uses node -e to programmatically edit tsconfig.json and tsconfig.app.json to configure path aliases.
  • scripts/bundle-artifact.sh executes pnpm exec parcel build and pnpm exec html-inline to generate the final artifact.
  • [EXTERNAL_DOWNLOADS]: The initialization process retrieves numerous standard development dependencies from the npm registry.
  • Fetches build tools and styling utilities including vite, tailwindcss, postcss, and autoprefixer.
  • Downloads a comprehensive set of UI primitives from the @radix-ui organization and other well-known frontend libraries like lucide-react, sonner, and zod.
  • The script optionally installs the pnpm package manager globally using npm install -g pnpm if it is not already present on the system.
  • [SAFE]: The skill's operations are transparent and consistent with its stated purpose as a frontend development toolkit. No attempts at data exfiltration, credential harvesting, or malicious prompt injection were observed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:06 PM
Security Audit — agent-trust-hub — web-artifacts-builder