The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The skill's initialization and bundling scripts (init-artifact.sh, bundle-artifact.sh) download and install over 50 Node.js packages from the npm registry. This significant dependency tree increases the attack surface for supply chain vulnerabilities.
[COMMAND_EXECUTION] (MEDIUM): The script init-artifact.sh performs high-impact operations including the global installation of pnpm (npm install -g pnpm) if not detected. It also extracts an opaque binary tarball (shadcn-components.tar.gz) included with the skill to the filesystem.
[REMOTE_CODE_EXECUTION] (MEDIUM): The script executes pnpm create vite, which fetches and runs code from the create-vite starter template at runtime. This constitutes execution of code not locally present in the skill.
[DYNAMIC_EXECUTION] (MEDIUM): The skill utilizes node -e to execute inline JavaScript strings for programmatically modifying configuration files (tsconfig.json). While the strings are currently static, this pattern is often a precursor to more dangerous dynamic execution.
[INDIRECT_PROMPT_INJECTION] (LOW): The project name provided by the user is interpolated into a sed command in init-artifact.sh without sanitization. An adversarial project name could manipulate the sed stream or inject malicious HTML/JS into the resulting index.html title tag.
Ingestion points: Project name variable $1 in scripts/init-artifact.sh.
Boundary markers: None present; input is used directly in a shell command and HTML template.
Capability inventory: Shell execution (bash), package management (pnpm, npm), and file extraction (tar).
Sanitization: Absent. No validation is performed on the project name string before use in sed or HTML.

web-artifacts-builder