web-artifacts-builder
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The project initialization script
scripts/init-artifact.shaccepts a project name as a command-line argument and interpolates it into shell commands andsedpatterns without prior validation or escaping. This allows for potential command injection or arbitrary file content modification if the input is maliciously crafted. - [COMMAND_EXECUTION]: The script
scripts/init-artifact.shperforms a global installation of thepnpmpackage manager (npm install -g pnpm). Modifying global system state is a violation of the principle of least privilege and can cause environment conflicts or permission errors. - [EXTERNAL_DOWNLOADS]: The initialization and bundling scripts (
scripts/init-artifact.sh,scripts/bundle-artifact.sh) download and install numerous packages from the public NPM registry, including Vite, Tailwind CSS, Parcel, and various Radix UI components. While these are well-known technology projects, the automated installation of a large dependency tree increases the supply chain attack surface.
Audit Metadata