Security Audit
web-artifacts-builder
github.com/guanyang/antigravity-skillsTrust Assessment
web-artifacts-builder received a trust score of 30/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 1 critical, 2 high, 1 medium, and 1 low severity. Key findings include Command Injection via Unsanitized Project Name, Unpinned Dependencies Lead to Supply Chain Risk, Untrusted Binary Blob (Tarball) as Supply Chain Risk.
The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. The static_code_analysis layer scored lowest at 31/100, indicating areas for improvement.
Last analyzed on February 15, 2026 (commit 3e75fabd). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via Unsanitized Project Name The `init-artifact.sh` script directly interpolates the user-provided project name (`$1`) into shell commands without proper sanitization. A malicious project name containing shell metacharacters (e.g., `;`, `&&`, `|`) could lead to arbitrary command execution on the host system. Specifically, `pnpm create vite "$PROJECT_NAME"` and `cd "$PROJECT_NAME"` are vulnerable. For example, if `$PROJECT_NAME` is `my-project; rm -rf /`, the `rm -rf /` command would be executed. Sanitize the `PROJECT_NAME` variable to remove or escape shell metacharacters before using it in shell commands. A common approach is to use `printf %q` for shell arguments or strictly validate the input to only allow alphanumeric characters and hyphens. | Unknown | scripts/init-artifact.sh:40 | |
| HIGH | Unpinned Dependencies Lead to Supply Chain Risk The `bundle-artifact.sh` script installs development dependencies (`parcel`, `@parcel/config-default`, `parcel-resolver-tspaths`, `html-inline`) without specifying exact versions, relying on `latest`. Similarly, `init-artifact.sh` installs runtime dependencies (`class-variance-authority`, `clsx`, `tailwind-merge`, `lucide-react`, `next-themes`) without pinning versions. This practice introduces a supply chain risk, as a malicious actor could publish a compromised version of any of these packages, which would then be automatically downloaded and executed by the skill. Pin all dependencies to exact versions (e.g., `parcel@2.10.0`). Regularly audit and update these pinned versions to ensure security and stability. Consider using a lockfile (`pnpm-lock.yaml`) and ensuring it's committed and used consistently. | Unknown | scripts/bundle-artifact.sh:22 | |
| HIGH | Unpinned Dependencies Lead to Supply Chain Risk The `init-artifact.sh` script installs runtime dependencies (`class-variance-authority`, `clsx`, `tailwind-merge`, `lucide-react`, `next-themes`) without specifying exact versions, relying on `latest`. This practice introduces a supply chain risk, as a malicious actor could publish a compromised version of any of these packages, which would then be automatically downloaded and executed by the skill. Pin all dependencies to exact versions (e.g., `class-variance-authority@0.7.0`). Regularly audit and update these pinned versions to ensure security and stability. Consider using a lockfile (`pnpm-lock.yaml`) and ensuring it's committed and used consistently. | Unknown | scripts/init-artifact.sh:70 | |
| MEDIUM | Untrusted Binary Blob (Tarball) as Supply Chain Risk The `init-artifact.sh` script relies on a local `shadcn-components.tar.gz` file, which is provided as untrusted binary content. If this tarball contains malicious files (e.g., files with absolute paths or path traversal sequences like `../../`) and is extracted without proper sanitization (e.g., using `tar -xzf` without `--no-absolute-paths` or similar flags), it could lead to arbitrary file overwrites or placement of malicious files outside the intended project directory. The exact extraction command is not visible due to truncation, but the presence of an untrusted binary blob that is intended for extraction poses a risk. If possible, avoid distributing binary blobs. If necessary, ensure the tarball is sourced from a trusted location and its integrity is verified (e.g., via checksums). When extracting, use `tar` commands with options like `--no-absolute-paths` and `--strip-components` to mitigate path traversal vulnerabilities. Alternatively, unpack in a temporary, isolated directory and then selectively copy files. | Unknown | scripts/init-artifact.sh:36 | |
| LOW | Cross-Site Scripting (XSS) in Generated HTML Artifact The `init-artifact.sh` script inserts the user-provided project name (`$PROJECT_NAME`) directly into the `<title>` tag of the generated `index.html` file using `sed`. If a malicious user provides a project name containing HTML entities or script tags (e.g., `"><script>alert(1)</script><"`), this will result in a Cross-Site Scripting (XSS) vulnerability in the final `bundle.html` artifact. While this does not directly affect the LLM's execution environment, it compromises the security of the artifact produced by the skill, which could impact the end-user viewing the artifact in a browser. Sanitize the `PROJECT_NAME` variable to escape HTML special characters (e.g., `<`, `>`, `"`, `'`, `&`) before inserting it into the HTML context. For example, replace `<` with `<`, `>` with `>`, etc. This ensures that the input is treated as plain text within the HTML title. | Unknown | scripts/init-artifact.sh:50 |
Scan History
Embed Code
[](https://skillshield.io/report/9c9b19d95ba7c310)
Powered by SkillShield