web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell scripts (scripts/init-artifact.sh and scripts/bundle-artifact.sh) to automate the web development lifecycle. These scripts execute commands for directory management, file manipulation, and building the project assets.
  • [EXTERNAL_DOWNLOADS]: The scripts download and install numerous standard frontend development packages from the official NPM registry, including Vite, Parcel, Tailwind CSS, and various UI component libraries. These are well-known and widely used technology services.
  • [COMMAND_EXECUTION]: The init-artifact.sh script attempts to install pnpm globally using npm install -g pnpm if it is not detected on the system. This is a standard setup procedure for this toolchain but may require elevated permissions.
  • [COMMAND_EXECUTION]: The initialization script takes a project name as an argument and interpolates it into shell commands. While common in developer tools, this represents a potential surface for command injection if malicious project names are supplied.
  • [COMMAND_EXECUTION]: The setup script extracts a pre-packaged components archive (shadcn-components.tar.gz) located within the skill's script directory to provide a foundational UI library.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 10:09 PM
Security Audit — agent-trust-hub — web-artifacts-builder