artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of local shell scripts, specifically scripts/init-artifact.sh and scripts/bundle-artifact.sh. These scripts are used to initialize a React/TypeScript development environment and to bundle the resulting code into a single HTML file. This is a primary function of the skill and aligns with its stated developer-centric purpose.
  • [EXTERNAL_DOWNLOADS]: During the bundling process, the skill instructions indicate that it installs several Node.js dependencies from the public npm registry, such as parcel, @parcel/config-default, parcel-resolver-tspaths, and html-inline. These are well-known build tools.
  • [PROMPT_INJECTION]: As an artifact generation tool, the skill processes user requests to build code. While this creates an indirect prompt injection surface where user instructions are translated into executable HTML/JS, the skill is designed for development environments where such behavior is expected, and no malicious patterns were detected in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 02:27 PM
Security Audit — agent-trust-hub — artifacts-builder