Skills
Navigate
skills/involvex/skills/web-artifacts-builder/Gen Agent Trust Hub

web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/init-artifact.sh script incorporates the user-supplied project name argument directly into shell commands and sed operations without sanitization. This allows for potential command injection if a crafted project name containing shell metacharacters or sed delimiters is provided.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes a vulnerability surface where untrusted user input (project name) is processed by powerful tools.
  • Ingestion points: scripts/init-artifact.sh (command-line argument).
  • Boundary markers: Absent.
  • Capability inventory: Includes shell command execution, file system modification, and package installation.
  • Sanitization: Absent.
  • [PRIVILEGE_ESCALATION]: The scripts/init-artifact.sh script performs a global installation of the pnpm package manager (npm install -g pnpm) if it is not already present, which modifies the system environment beyond the skill's local scope.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 05:22 PM