Security Audit
web-artifacts-builder
github.com/davila7/claude-code-templatesTrust Assessment
web-artifacts-builder received a trust score of 55/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 1 critical, 1 high, 2 medium, and 1 low severity. Key findings include Network egress to untrusted endpoints, Covert behavior / concealment directives, Command Injection via Unsanitized Project Name.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 458b1186). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Unsanitized Project Name The `scripts/init-artifact.sh` script directly uses the user-provided project name (`$1`) in multiple shell commands without proper sanitization. This allows an attacker to inject arbitrary shell commands by crafting a malicious project name. For example, a project name like `'; rm -rf /; echo pwned'` could lead to arbitrary code execution on the host system. This vulnerability affects commands such as `pnpm create vite`, `cd`, and `sed`. Sanitize the `$PROJECT_NAME` variable to remove or escape shell metacharacters before using it in commands. A common approach is to validate the project name against a strict regex (e.g., alphanumeric, hyphens, underscores only) or use a library function that safely escapes shell arguments. | LLM | scripts/init-artifact.sh:35 | |
| HIGH | Global Package Installation with Elevated Privileges The `scripts/init-artifact.sh` script attempts to install `pnpm` globally using `npm install -g pnpm` if it's not found. Global package installations often require elevated privileges and can introduce system-wide dependencies. This action increases the attack surface and could be exploited if the `npm` registry or the `pnpm` package itself is compromised, leading to a supply chain attack or privilege escalation. It also indicates excessive permissions for a skill if it's allowed to modify the global environment. Avoid global package installations within an agent skill. Ensure the execution environment provides necessary tools or uses a sandboxed, isolated environment (e.g., Docker container) where dependencies are pre-installed or installed locally to the project. If `pnpm` is a hard requirement, it should be part of the agent's base environment, not installed by the skill itself. | LLM | scripts/init-artifact.sh:28 | |
| MEDIUM | Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | cli-tool/components/mcps/devtools/figma-dev-mode.json:4 | |
| MEDIUM | Unpinned Dependencies in Build Scripts Both `scripts/bundle-artifact.sh` and `scripts/init-artifact.sh` install Node.js packages without specifying exact versions for all dependencies. This introduces a supply chain risk, as future installations might pull in newer, potentially incompatible, or even malicious versions of these packages. For example, `pnpm add -D parcel ... html-inline` in `bundle-artifact.sh` and several `pnpm install` commands in `init-artifact.sh` do not pin versions for all packages (e.g., `postcss`, `autoprefixer`, `@types/node`, `tailwindcss-animate`, `class-variance-authority`, `clsx`, `tailwind-merge`, `lucide-react`, `next-themes`). Pin all dependencies to exact versions (e.g., `parcel@2.10.0`, `postcss@8.4.31`) to ensure reproducible builds and mitigate the risk of malicious updates or breaking changes from upstream packages. Use a `pnpm-lock.yaml` file and ensure `pnpm install` is used without `add` for production builds. | LLM | scripts/bundle-artifact.sh:20 | |
| LOW | Covert behavior / concealment directives Multiple zero-width characters (stealth text) Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | cli-tool/components/mcps/devtools/jfrog.json:4 |
Scan History
Embed Code
[](https://skillshield.io/report/44c403220e23681f)
Powered by SkillShield