artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on bash scripts (
init-artifact.shandbundle-artifact.sh) to automate the developer workflow, including project scaffolding, dependency management, and asset bundling. - [EXTERNAL_DOWNLOADS]: The initialization and bundling scripts download a wide range of standard frontend development packages (React, Radix UI, Tailwind CSS, Parcel) from the official NPM registry using
pnpm. - [DYNAMIC_EXECUTION]: The
init-artifact.shscript utilizes inline Node.js commands (node -e) to programmatically parse and modifytsconfig.jsonandtsconfig.app.jsonconfiguration files during project setup. - [PRIVILEGE_ESCALATION]: The initialization script attempts to install the
pnpmpackage manager globally vianpm install -g pnpmif it is not detected on the system path.
Audit Metadata