The Agent Skills Directory

[COMMAND_EXECUTION]: The initialization script scripts/init-artifact.sh is vulnerable to shell command injection. The project name provided by the user is interpolated into multiple shell commands, including a sed expression, without sufficient sanitization or quoting to prevent shell breakout.
Evidence in scripts/init-artifact.sh: $SED_INPLACE 's/<title>.*<\/title>/<title>'"$PROJECT_NAME"'<\/title>/' index.html
[PRIVILEGE_ESCALATION]: The scripts/init-artifact.sh script attempts to install the pnpm package manager globally using npm install -g pnpm if it is not found on the system. This operation typically requires administrative or root privileges and modifies the global system environment.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs a large number of packages from the npm registry during both the initialization and bundling phases. These include the Vite build tool, Tailwind CSS, Parcel, and several dozen UI component libraries.
Evidence: The scripts use pnpm install, pnpm add, and pnpm create vite to fetch remote code and assets.
[DYNAMIC_EXECUTION]: The initialization script uses Node.js to programmatically edit configuration files (tsconfig.json and tsconfig.app.json) by executing inline JavaScript code that performs file system operations and JSON manipulation.
Evidence in scripts/init-artifact.sh: node -e "const fs = require('fs'); ..."

web-artifacts-builder