The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell scripts (scripts/init-artifact.sh and scripts/bundle-artifact.sh) to automate project scaffolding and bundling. These scripts execute standard development commands such as bun install, bunx vite build, and bun add.
The logic includes robust concurrency handling using atomic directory locks (.bundle-install.lock) to prevent race conditions during package installation.
Testing scripts (tests/*.py) utilize subprocess.run to validate the build pipeline, which is standard practice for infrastructure testing.
[EXTERNAL_DOWNLOADS]: The skill downloads standard frontend dependencies (e.g., vite, react, tailwindcss, parse5, css-tree) from the official npm registry using bun. These are well-known, version-pinned packages required for the skill's primary purpose of building web artifacts.
[DATA_EXFILTRATION]: The bundling script (scripts/inline-local-assets.mjs) includes significant security protections to prevent data leakage:
It walks the file system component-by-component using lstat to explicitly reject symlinks and hard links that could point to sensitive files outside the project root (e.g., ~/.ssh or ~/.aws).
It utilizes a private snapshot directory with restricted permissions (mode 0700) and performs inode/device verification during the inlining process to prevent Time-of-Check to Time-of-Use (TOCTOU) attacks.
It enforces a strict within(path, base) check to ensure all assets originate from the build directory or the project's public/ folder.

artifacts-builder