The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts automate the installation of numerous dependencies from the npm registry, including frameworks like React, Vite, and various UI libraries. While these are well-known services, they constitute a large supply chain surface area for a single skill.
[COMMAND_EXECUTION]: The skill executes multiple shell scripts (scripts/init-artifact.sh and scripts/bundle-artifact.sh) to manage the project lifecycle, involving file system operations and build tool execution.
[PRIVILEGE_ESCALATION]: The initialization script attempts to perform a global installation of the pnpm package manager using npm install -g pnpm. This action typically requires administrative privileges and modifies the host system's global environment beyond the scope of the local project.
[DYNAMIC_EXECUTION]: The initialization script utilizes node -e to execute inline JavaScript for programmatically updating configuration files such as tsconfig.json. This involves runtime processing of JSON data and string manipulation to configure path aliases.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates a workflow where the agent creates frontend code based on user requests, which is then bundled and rendered. This creates an attack surface where malicious instructions in a user's prompt could be embedded into the artifact's source code.
Ingestion points: User instructions for artifact features are processed to generate source files in the src/ directory via the agent's code generation capabilities.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat user-provided data as untrusted or to ignore embedded instructions within the generated code.
Capability inventory: The skill enables file writing, shell script execution, and bundling of assets that could be influenced by injected content.
Sanitization: There is no evidence of sanitization or escaping mechanisms to prevent user-provided strings from interfering with the logic or behavior of the generated React components.
[REMOTE_CODE_EXECUTION]: The scripts/init-artifact.sh script extracts a local archive file, scripts/shadcn-components.tar.gz, into the project's source directory. As the contents of this tarball are not included in the provided source for analysis, it represents an unverifiable dependency that could potentially contain malicious code or be used in a path traversal attack during extraction.

web-artifacts-builder