artifacts-builder
Warn
Audited by Gen Agent Trust Hub on Feb 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The
scripts/init-artifact.shscript executespnpm create vite, which fetches and runs external code to bootstrap the project from a remote template.\n- [COMMAND_EXECUTION] (MEDIUM): The skill performs extensive shell operations, including project initialization, file system manipulation withsed, and a global software installation usingnpm install -g pnpm.\n- [REMOTE_CODE_EXECUTION] (MEDIUM): The bundling and initialization processes involve installing and running dozens of third-party Node.js packages from the npm registry, which are executed in the local environment during the build process.\n- [DYNAMIC_EXECUTION] (MEDIUM): The skill usesnode -eto dynamically execute JavaScript snippets for modifyingtsconfig.jsonandtsconfig.app.jsonfiles during the setup phase.\n- [INDIRECT_PROMPT_INJECTION] (LOW): The skill represents a surface for indirect prompt injection as it processes agent-generated React code (which may be influenced by untrusted user data) and executes build tools on that content without formal sanitization or boundary markers.
Audit Metadata