The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/init-artifact.sh attempts to install the pnpm package manager globally using npm install -g pnpm if it is not already present, which modifies the system-wide environment.
[COMMAND_EXECUTION]: The project initialization script scripts/init-artifact.sh is vulnerable to command injection because it interpolates the user-provided project name directly into shell commands and sed expressions without sanitization or quoting.
Ingestion point: Project name argument in scripts/init-artifact.sh.
Boundary markers: None provided to delimit the input from the command logic.
Capability inventory: Script executes pnpm, sed, tar, and node commands.
Sanitization: No validation or escaping is applied to the input variable.
[COMMAND_EXECUTION]: The skill uses node -e to programmatically edit configuration files (tsconfig.json and tsconfig.app.json) by executing inline JavaScript code during project setup.
[EXTERNAL_DOWNLOADS]: The skill's scripts download and install a large number of third-party packages from the NPM registry, creating a significant dependency footprint including Vite, Parcel, and various UI component libraries.
[SAFE]: Documentation in references/artifact-patterns.md includes links to trusted CDNs such as unpkg.com for standard frontend libraries, which is consistent with normal development practices.

web-artifacts-builder