web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/init-artifact.shandscripts/bundle-artifact.sh) to automate environment setup and build processes. These scripts execute a variety of commands includingpnpm,tar,sed, andnodeto scaffold the project and manage configurations. - [EXTERNAL_DOWNLOADS]: The scripts download and install numerous legitimate frontend development packages from the NPM registry, including React, Vite, Tailwind CSS, and various Radix UI primitives. It also attempts to install
pnpmglobally if not already present. - [DYNAMIC_EXECUTION]: The initialization script dynamically generates project configuration files such as
vite.config.ts,tailwind.config.js, andtsconfig.jsonusing shell heredocs and inline Node.js execution. This is a standard practice for project scaffolding tools. - [COMMAND_EXECUTION]: The bundling process involves running
parcel buildandhtml-inlineviapnpm execto transform source code into a single-file HTML artifact.
Audit Metadata