web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses bash scripts to automate the creation and bundling of React projects.
- The
init-artifact.shscript executes standard project initialization commands such aspnpm create viteand variouspnpm installcommands for well-known frontend libraries (e.g., Radix UI, Tailwind CSS, Lucide). - The
bundle-artifact.shscript uses Parcel andhtml-inlineto package the development project into a single distributable HTML file. - These actions are consistent with the skill's stated purpose of building web artifacts.
- [EXTERNAL_DOWNLOADS]: The scripts download numerous dependencies from official package registries (npm/pnpm).
- The packages include standard industry tools like
vite,tailwindcss,parcel, and@radix-ui/*components. - All network operations target standard registries to fetch legitimate development dependencies.
- [DYNAMIC_EXECUTION]: The
init-artifact.shscript utilizesnode -eto programmatically update configuration files (tsconfig.json). - This is a common and safe practice for automated project scaffolding to ensure correct path aliasing and compiler settings.
- [DATA_EXPOSURE]: No evidence of sensitive file access or credential exfiltration was found. The scripts operate within the project directory to manage source code and build artifacts.
Audit Metadata