web-artifacts-builder

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs multiple package installations from the official npm registry using npm and pnpm. It installs standard development tools like Vite, Parcel, and numerous UI-related libraries (Radix UI, Tailwind CSS, etc.) as part of the project initialization and bundling process.
  • [COMMAND_EXECUTION]: The initialization script uses sed and node -e (dynamic execution) to programmatically modify configuration files such as index.html, tsconfig.json, and tsconfig.app.json. These operations are limited to project scaffolding tasks like setting path aliases and project names.
  • [COMMAND_EXECUTION]: The script scripts/init-artifact.sh extracts a local tarball shadcn-components.tar.gz to the src/ directory. This is used to pre-install UI components into the scaffolded project.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 12:20 PM
Security Audit — agent-trust-hub — web-artifacts-builder