web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/init-artifact.shandscripts/bundle-artifact.sh) to automate the web development lifecycle. These scripts execute commands for directory management, file manipulation, and building the project assets. - [EXTERNAL_DOWNLOADS]: The scripts download and install numerous standard frontend development packages from the official NPM registry, including Vite, Parcel, Tailwind CSS, and various UI component libraries. These are well-known and widely used technology services.
- [COMMAND_EXECUTION]: The
init-artifact.shscript attempts to installpnpmglobally usingnpm install -g pnpmif it is not detected on the system. This is a standard setup procedure for this toolchain but may require elevated permissions. - [COMMAND_EXECUTION]: The initialization script takes a project name as an argument and interpolates it into shell commands. While common in developer tools, this represents a potential surface for command injection if malicious project names are supplied.
- [COMMAND_EXECUTION]: The setup script extracts a pre-packaged components archive (
shadcn-components.tar.gz) located within the skill's script directory to provide a foundational UI library.
Audit Metadata