web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs multiple package installations from the official npm registry using
npmandpnpm. It installs standard development tools like Vite, Parcel, and numerous UI-related libraries (Radix UI, Tailwind CSS, etc.) as part of the project initialization and bundling process. - [COMMAND_EXECUTION]: The initialization script uses
sedandnode -e(dynamic execution) to programmatically modify configuration files such asindex.html,tsconfig.json, andtsconfig.app.json. These operations are limited to project scaffolding tasks like setting path aliases and project names. - [COMMAND_EXECUTION]: The script
scripts/init-artifact.shextracts a local tarballshadcn-components.tar.gzto thesrc/directory. This is used to pre-install UI components into the scaffolded project.
Audit Metadata