web-artifacts-builder
Fail
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (HIGH): Potential shell command injection in
scripts/init-artifact.sh. The project name provided as the first argument is interpolated directly into shell commands (pnpm create vite "$PROJECT_NAME") andsedexpressions without sanitization, allowing arbitrary command execution. - EXTERNAL_DOWNLOADS (MEDIUM): The scripts perform extensive runtime package installations using
npmandpnpm. It specifically attempts to installpnpmglobally (npm install -g pnpm), which is a high-privilege operation and introduces supply chain risks. - COMMAND_EXECUTION (MEDIUM):
scripts/init-artifact.shusesnode -eto execute inline JavaScript for modifying configuration files at runtime, which is a form of dynamic execution that complicates security auditing.
Recommendations
- AI detected serious security threats
Audit Metadata