The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/init-artifact.sh script is vulnerable to shell command injection through the PROJECT_NAME argument. The variable is interpolated into a sed command using a pattern that allows an attacker to break out of the intended string and execute arbitrary shell commands.
Evidence: Line 66 in scripts/init-artifact.sh uses $SED_INPLACE 's/<title>.*<\/title>/<title>'"$PROJECT_NAME"'<\/title>/' index.html which is susceptible to injection if the project name contains single quotes or shell metacharacters.
[COMMAND_EXECUTION]: The scripts/init-artifact.sh script executes npm install -g pnpm, which installs a package globally on the system, potentially altering the environment without explicit user confirmation.
Evidence: Line 43 in scripts/init-artifact.sh.
[EXTERNAL_DOWNLOADS]: The skill's scripts download and install numerous packages from the npm registry (npmjs.org). While these are standard development libraries (Vite, Tailwind CSS, Radix UI, Parcel), they constitute a significant external dependency surface.
Evidence: Multiple pnpm install and pnpm add commands throughout the initialization and bundling scripts.
[COMMAND_EXECUTION]: The scripts/init-artifact.sh script utilizes node -e to execute dynamic JavaScript code for modifying project configuration files.
Evidence: Lines 183 and 195 in scripts/init-artifact.sh.

web-artifacts-builder