web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes bash scripts (
init-artifact.shandbundle-artifact.sh) to manage the project lifecycle, including file system operations and tool invocation. - [COMMAND_EXECUTION]: Uses
node -eto programmatically modify local configuration files such astsconfig.jsonduring the initialization phase. - [COMMAND_EXECUTION]: Installs the
pnpmpackage manager globally on the system if it is not already present, which involves modifying the global environment. - [EXTERNAL_DOWNLOADS]: Fetches and installs numerous standard frontend development packages from the official NPM registry to satisfy project dependencies.
- [INDIRECT_PROMPT_INJECTION]: As a tool that generates and builds code based on agent instructions (which may be influenced by user input), it presents a surface for indirect injection; however, it follows standard build patterns and does not exhibit malicious behavior.
Audit Metadata