The Agent Skills Directory

[COMMAND_EXECUTION]: The initialization script scripts/init-artifact.sh utilizes a user-provided project name argument ($1) directly in shell commands and sed text replacements. While the variable is quoted in most shell contexts, its use in the sed command string is susceptible to injection or command failure if the project name contains certain characters like forward slashes.
Evidence: PROJECT_NAME="$1", pnpm create vite "$PROJECT_NAME", and $SED_INPLACE 's/<title>.*<\/title>/<title>'"$PROJECT_NAME"'<\/title>/' index.html in scripts/init-artifact.sh.
[EXTERNAL_DOWNLOADS]: The skill performs global installation of the pnpm package manager (if missing) and installs a large number of development dependencies from the standard NPM registry to set up the development environment.
Evidence: npm install -g pnpm and multiple pnpm install calls across scripts/init-artifact.sh and scripts/bundle-artifact.sh.
[DYNAMIC_EXECUTION]: The skill uses node -e to execute small JavaScript snippets for programmatically modifying JSON configuration files like tsconfig.json. These scripts are hardcoded and do not process external input, making them relatively safe in this context.

web-artifacts-builder