web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell scripts (init-artifact.sh and bundle-artifact.sh) that use various system utilities to manage project infrastructure:
  • Uses sed for in-place text replacement in HTML templates during initialization.
  • Uses cat to generate configuration files for PostCSS, Tailwind CSS, and Parcel (.parcelrc).
  • Uses node -e to programmatically parse and update tsconfig.json and tsconfig.app.json to configure path aliases.
  • Uses tar to extract a local components archive (shadcn-components.tar.gz) containing pre-built UI components into the source directory.
  • [EXTERNAL_DOWNLOADS]: The skill performs multiple package installations from standard registries (npm/pnpm):
  • Attempts to install pnpm globally via npm if it is not already present on the system.
  • Bootstraps projects using pnpm create vite, which fetches official project templates.
  • Installs a comprehensive list of standard frontend dependencies, including React, Radix UI components, Tailwind CSS, and bundling tools like Parcel and html-inline. All dependencies are well-known packages from official registries.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 08:18 AM
Security Audit — agent-trust-hub — web-artifacts-builder