web-artifacts-builder
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The
init-artifact.shandbundle-artifact.shscripts install numerous packages from the public npm registry usingpnpm installandnpm install -g. This introduces dependency on external, unverified third-party code. - COMMAND_EXECUTION (MEDIUM): The skill makes extensive use of shell commands to create directories, write configuration files via heredocs (
cat > file << 'EOF'), and run build tools likeparcelandhtml-inline. - REMOTE_CODE_EXECUTION (MEDIUM): The command
pnpm create vitedownloads and executes a remote initialization script from the npm registry, which is a form of remote code execution. - DYNAMIC_EXECUTION (LOW): The script
init-artifact.shusesnode -eto programmatically modifytsconfig.jsonfiles. While targeted at local files created by the skill, it represents dynamic code execution within the environment.
Audit Metadata