The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The scripts/init-artifact.sh script installs over 50 Node.js packages from the NPM registry and utilizes pnpm create vite to fetch and execute remote scaffolding code at runtime.
[REMOTE_CODE_EXECUTION] (MEDIUM): The scripts/bundle-artifact.sh script dynamically installs parcel and html-inline and immediately executes them via pnpm exec to bundle the project.
[COMMAND_EXECUTION] (MEDIUM): In scripts/init-artifact.sh, the user-provided $PROJECT_NAME variable is directly interpolated into a sed command: $SED_INPLACE 's/<title>.*<\/title>/<title> '"$PROJECT_NAME"' <\/title>/' index.html. If the project name contains characters like / or shell metacharacters, it can lead to command failure or unexpected code execution.
[COMMAND_EXECUTION] (LOW): The initialization script attempts a global installation of pnpm (npm install -g pnpm) if the command is not found on the path, which may exceed intended permission boundaries in some environments.
[REMOTE_CODE_EXECUTION] (MEDIUM): The script scripts/init-artifact.sh extracts a local archive shadcn-components.tar.gz. Since the contents of this archive are not provided for analysis, it represents an opaque execution surface that could contain malicious scripts or components.

artifacts-builder