artifacts-builder

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on bash scripts (init-artifact.sh and bundle-artifact.sh) to automate the developer workflow, including project scaffolding, dependency management, and asset bundling.
  • [EXTERNAL_DOWNLOADS]: The initialization and bundling scripts download a wide range of standard frontend development packages (React, Radix UI, Tailwind CSS, Parcel) from the official NPM registry using pnpm.
  • [DYNAMIC_EXECUTION]: The init-artifact.sh script utilizes inline Node.js commands (node -e) to programmatically parse and modify tsconfig.json and tsconfig.app.json configuration files during project setup.
  • [PRIVILEGE_ESCALATION]: The initialization script attempts to install the pnpm package manager globally via npm install -g pnpm if it is not detected on the system path.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 12:28 AM