artifacts-builder
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local shell scripts 'scripts/init-artifact.sh' and 'scripts/bundle-artifact.sh' to manage project setup and bundling tasks.
- [EXTERNAL_DOWNLOADS]: The tool automates the installation of well-known development packages including Parcel, Vite, and Tailwind CSS from the official Node.js registry.
- [PROMPT_INJECTION]: The skill instructions define an indirect injection surface where project names and generated code are processed by build scripts.
- Ingestion points: User-supplied project names and generated React/TypeScript source files.
- Boundary markers: No specific delimiters or safety instructions for handling untrusted code are provided.
- Capability inventory: The skill allows shell execution and file system writes within the build directory.
- Sanitization: No input validation or sanitization logic for project names is mentioned in the documentation.
Audit Metadata