Skills
skills/guanyang/antigravity-skills/web-artifacts-builder/Gen Agent Trust Hub

web-artifacts-builder

Warn

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS] (MEDIUM): The scripts init-artifact.sh and bundle-artifact.sh install a large volume of dependencies from the npm registry (including vite, tailwindcss, and 40+ shadcn/ui related packages). While typical for web development, this involves automated remote package fetching and execution during project setup.\n- [COMMAND_EXECUTION] (MEDIUM): The init-artifact.sh script executes npm install -g pnpm if the pnpm command is missing. Global installations are a form of system-wide environment modification that usually requires elevated privileges and can affect other applications on the host.\n- [COMMAND_EXECUTION] (LOW): The skill uses node -e to execute JavaScript code from the shell to modify JSON configuration files. Although these scripts are hardcoded and intended for configuration, they represent dynamic code invocation on the local system.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 17, 2026, 06:04 PM