web-artifacts-builder
Warn
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The script
scripts/init-artifact.shinstalls thepnpmpackage manager globally usingnpm install -g pnpm. This modifies the system-wide environment and may require elevated privileges. - EXTERNAL_DOWNLOADS (MEDIUM): Both
init-artifact.shandbundle-artifact.shdownload and install numerous third-party packages from the public npm registry at runtime (e.g.,parcel,radix-uicomponents,tailwindcss). This introduces a dependency on external code that is not pinned by hash or bundled with the skill, creating a supply chain risk. - COMMAND_EXECUTION (LOW): The scripts utilize
node -eandsedto programmatically rewrite configuration files liketsconfig.jsonandvite.config.ts. While standard for scaffolding, dynamic modification of project configuration files is a minor concern in automated contexts. - COMMAND_EXECUTION (LOW): The skill executes
pnpm create viteandparcel build, which involve running external generators and build pipelines on the local machine.
Audit Metadata