artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of local shell scripts, specifically
scripts/init-artifact.shandscripts/bundle-artifact.sh. These scripts are used to initialize a React/TypeScript development environment and to bundle the resulting code into a single HTML file. This is a primary function of the skill and aligns with its stated developer-centric purpose. - [EXTERNAL_DOWNLOADS]: During the bundling process, the skill instructions indicate that it installs several Node.js dependencies from the public npm registry, such as
parcel,@parcel/config-default,parcel-resolver-tspaths, andhtml-inline. These are well-known build tools. - [PROMPT_INJECTION]: As an artifact generation tool, the skill processes user requests to build code. While this creates an indirect prompt injection surface where user instructions are translated into executable HTML/JS, the skill is designed for development environments where such behavior is expected, and no malicious patterns were detected in the instructions.
Audit Metadata