Skills
skills/4444j99/a-i--skills/web-artifacts-builder/Gen Agent Trust Hub

web-artifacts-builder

Warn

Audited by Gen Agent Trust Hub on Apr 19, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/init-artifact.sh performs a global installation of the pnpm package manager.
  • Evidence: The command npm install -g pnpm is executed if pnpm is not detected in the environment.
  • [COMMAND_EXECUTION]: The scripts/init-artifact.sh script executes shell commands using unvalidated user-supplied input.
  • Evidence: The $PROJECT_NAME variable is passed directly to pnpm create vite "$PROJECT_NAME".
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs a large set of dependencies from the official NPM registry.
  • Evidence: The initialization and bundling scripts execute pnpm install and pnpm add for numerous packages including vite, tailwindcss, parcel, and over 40 Radix UI and shadcn components.
  • [EXTERNAL_DOWNLOADS]: The skill references components from well-known frontend documentation services.
  • Evidence: Link to https://ui.shadcn.com/docs/components in SKILL.md.
  • [REMOTE_CODE_EXECUTION]: The build pipeline executes downloaded binaries from the local environment to process assets.
  • Evidence: Execution of pnpm exec parcel and pnpm exec html-inline in scripts/bundle-artifact.sh.
  • [COMMAND_EXECUTION]: The initialization process extracts a local compressed archive containing component source code.
  • Evidence: Use of tar -xzf "$COMPONENTS_TARBALL" in scripts/init-artifact.sh to extract shadcn-components.tar.gz.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 19, 2026, 03:25 AM