web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts download numerous packages from the official npm registry using
pnpmandnpm. This includes core development tools like Vite, Parcel, Tailwind CSS, and various UI component libraries (Radix UI). All identified packages are well-known and standard for the described web development tasks. - [COMMAND_EXECUTION]: The
init-artifact.shandbundle-artifact.shscripts execute various shell commands to set up the project environment, including creating directories, writing configuration files (JSON, TypeScript, CSS), and running build processes. These operations are consistent with the skill's primary purpose of automating project scaffolding. - [COMMAND_EXECUTION]: The initialization script uses
node -eto execute small inline JavaScript snippets for programmatically updatingtsconfig.jsonfiles. The logic is restricted to local file manipulation and does not involve untrusted data or network operations. - [COMMAND_EXECUTION]: The skill uses
pnpm dlx shadcn@latestto execute the official shadcn CLI for component installation. This is a standard method for integrating this UI framework into projects.
Audit Metadata