web-artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The 'init-artifact.sh' script installs the 'pnpm' package manager globally and numerous reputable frontend libraries (e.g., Vite, Tailwind, Radix UI) from the npm registry. \n- [COMMAND_EXECUTION] (LOW): The scripts utilize standard shell utilities including 'sed' for text replacement, 'tar' for extraction, and 'node -e' for modifying JSON configuration files. \n- [REMOTE_CODE_EXECUTION] (LOW): The tool executes Parcel and Vite binaries locally to facilitate the build and bundling of the web artifacts. \n- [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes AI-generated code to create the final artifact, which represents an injection surface if the code is executed in an environment with sensitive data access. Ingestion points: src/index.html and associated React source files. Boundary markers: None. Capability inventory: Shell execution for building and bundling via Parcel/Vite. Sanitization: None.
Audit Metadata