The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell scripts (init-artifact.sh and bundle-artifact.sh) to automate project setup and bundling. These scripts perform operations such as creating directories, cleaning build outputs, and extracting a local component tarball (shadcn-components.tar.gz).
[EXTERNAL_DOWNLOADS]: The initialization and bundling processes download numerous dependencies from the official NPM/PNPM registries. These include well-known and trusted packages such as Vite, Tailwind CSS, Radix UI, and Parcel, which are necessary for modern frontend development.
[PRIVILEGE_ESCALATION]: The init-artifact.sh script attempts to install pnpm globally using npm install -g pnpm if the command is not found. This modifies the system environment and typically requires elevated privileges.
[DYNAMIC_EXECUTION]: The setup script utilizes node -e to programmatically modify configuration files (tsconfig.json and tsconfig.app.json). This involves executing JavaScript code directly from the command line to parse and update project settings.
[INDIRECT_PROMPT_INJECTION]: The init-artifact.sh script accepts a project name as a command-line argument which is used directly in shell commands. While this presents an attack surface where a malicious input could attempt command injection, the capability is central to the skill's utility as a project generator.

web-artifacts-builder