web-artifacts-builder-v2
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/init-artifact.shandscripts/bundle-artifact.sh) to manage the project lifecycle, including initializing Vite projects, extracting component archives, and executing build commands. - [EXTERNAL_DOWNLOADS]: The setup scripts install numerous standard frontend development packages from the NPM registry and perform a global installation of the pnpm package manager.
- [DYNAMIC_EXECUTION]: The initialization process dynamically creates and modifies project configuration files, including
vite.config.ts,tsconfig.json, andcomponents.json. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates an environment for executing AI-generated code. 1. Ingestion points: The agent writes code directly to
src/App.tsxbased on user requirements. 2. Boundary markers: The instructions provide no specific isolation or delimiters for user-provided data. 3. Capability inventory: The environment supports shell script execution, package installation, and file system modification. 4. Sanitization: No explicit sanitization or validation of user-provided content is performed before interpolation into the project code.
Audit Metadata