web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses bash scripts to automate the creation and bundling of React projects.
  • The init-artifact.sh script executes standard project initialization commands such as pnpm create vite and various pnpm install commands for well-known frontend libraries (e.g., Radix UI, Tailwind CSS, Lucide).
  • The bundle-artifact.sh script uses Parcel and html-inline to package the development project into a single distributable HTML file.
  • These actions are consistent with the skill's stated purpose of building web artifacts.
  • [EXTERNAL_DOWNLOADS]: The scripts download numerous dependencies from official package registries (npm/pnpm).
  • The packages include standard industry tools like vite, tailwindcss, parcel, and @radix-ui/* components.
  • All network operations target standard registries to fetch legitimate development dependencies.
  • [DYNAMIC_EXECUTION]: The init-artifact.sh script utilizes node -e to programmatically update configuration files (tsconfig.json).
  • This is a common and safe practice for automated project scaffolding to ensure correct path aliasing and compiler settings.
  • [DATA_EXPOSURE]: No evidence of sensitive file access or credential exfiltration was found. The scripts operate within the project directory to manage source code and build artifacts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 08:42 AM