web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The scripts
init-artifact.shandbundle-artifact.shdownload and install a comprehensive list of frontend development packages from the NPM registry. While the packages (Vite, Radix UI, Tailwind, etc.) are widely used and reputable, the sheer volume of automated external dependencies should be noted as an inherent risk. - [REMOTE_CODE_EXECUTION] (LOW): The skill executes code from external sources via
pnpm install,npm install -g pnpm, andpnpm exec. These commands download and run binaries and scripts from the internet to perform build tasks. - [COMMAND_EXECUTION] (LOW): The
init-artifact.shscript usesnode -eto dynamically modify configuration files liketsconfig.json. This involves executing JavaScript code strings passed via the command line; however, the code is hardcoded in the script and performs benign JSON transformations. - [EXTERNAL_DOWNLOADS] (LOW): The
init-artifact.shscript attempts to globally installpnpmvianpm install -g pnpmif it is not found on the system. While this is a common utility installation, global package modifications are generally a minor security concern in multi-user environments.
Audit Metadata