web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to scaffold and build React projects. These operations are restricted to the local file system and are standard for development workflows.
- [EXTERNAL_DOWNLOADS]: The skill uses
npmandpnpmto download standard frontend packages from the official registries. All packages identified (Vite, Tailwind, Radix UI, Parcel) are well-known and reputable industry standards. - [PRIVILEGE_ESCALATION]: The skill attempts to install
pnpmglobally usingnpm install -g pnpmif it is not found. While this typically requires higher privileges, it is a common convenience step in developer environment setup scripts. - [REMOTE_CODE_EXECUTION]: While the skill installs and runs build tools (Vite/Parcel), it does not pipe remote scripts directly into the shell (e.g.,
curl | bash). It relies on standard package managers for execution.
Audit Metadata