web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The initialization and bundling scripts download standard frontend development packages from the official NPM registry. These include well-known libraries such as React, Vite, Tailwind CSS, and Radix UI primitives. The downloads are handled via standard package managers (npm and pnpm) from trusted sources.
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/init-artifact.shandscripts/bundle-artifact.sh) to automate project scaffolding and asset compilation. These scripts execute routine commands such aspnpm create vite,sedfor file modification, andparcelfor bundling. Additionally, small Node.js snippets are used programmatically to update configuration files liketsconfig.json. - [SAFE]: The skill operates entirely within the context of the user's project directory. No evidence of credential theft, unauthorized network communication, or persistence mechanisms was found. The code and instructions are transparent and strictly serve the documented purpose of building web artifacts.
Audit Metadata