The Agent Skills Directory

Command Execution: The skill automates project lifecycle tasks using shell scripts (init-artifact.sh and bundle-artifact.sh). These scripts execute various system and development utilities, such as pnpm, npm, tar, sed, and node. This degree of automation is common in developer tools but necessitates trust in the execution environment.
External Dependencies: The initialization and bundling scripts download and install many packages from the npm registry, including Vite, Tailwind CSS, Parcel, and Radix UI components. The security of the resulting artifact is dependent on the integrity of these external libraries and the registry itself.
Dynamic Configuration Updates: The initialization process employs node -e to programmatically update project configuration files, such as tsconfig.json. This dynamic execution of inline JavaScript is used for routine maintenance of project structure and path aliasing.
Untrusted Input Processing: The project initialization script accepts a user-provided project name as a command-line argument, which is then used in shell commands. Without strict validation, special characters in the project name could influence shell behavior during directory creation or package initialization.
Ingestion points: The PROJECT_NAME variable in scripts/init-artifact.sh is populated from user-supplied arguments.
Boundary markers: No specific boundary markers or "ignore" instructions are present for the project name input.
Capability inventory: The script performs file system operations, executes shell commands, and modifies configuration files.
Sanitization: No explicit sanitization or validation is performed on the project name before it is interpolated into shell commands.

web-artifacts-builder