web-artifacts-builder
Warn
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on complex shell scripts (init-artifact.sh and bundle-artifact.sh) to automate the setup and build process, which involve system-level file operations and process management.
- [EXTERNAL_DOWNLOADS]: The initialization script performs a global installation of the 'pnpm' package manager (npm install -g pnpm) and downloads a large number of external dependencies from the NPM registry during project setup.
- [REMOTE_CODE_EXECUTION]: The skill uses dynamic JavaScript execution (node -e) to programmatically modify project configuration files and executes build tools (Parcel) that run code downloaded from external registries.
- [REMOTE_CODE_EXECUTION]: The project initialization process depends on the extraction of a local binary tarball (shadcn-components.tar.gz) whose contents are not provided for security inspection, posing a risk of unverifiable code injection into the project source.
Audit Metadata