Web Artifacts Builder Anthropic

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:18 AM UTC
• Version: 1.0.0

Overview

This skill is a transparent web-app artifact builder, but it relies on normal JavaScript package-install workflows that users should run in an isolated project.

Install only if you are comfortable running local shell scripts that create project files and install JavaScript dependencies. Use a disposable workspace or container, avoid running with elevated privileges, inspect the scripts first, and consider pinning dependencies or using a lockfile for repeatable builds. Note that the inspected package references shadcn-components.tar.gz, but that file was not present in the workspace, so initialization may fail unless the package is completed elsewhere.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/init-artifact.sh:34

Finding

Unpinned third-party packages are downloaded and executed during project initialization

Content

View full analysis

Vulnerability Details

File Location: scripts/init-artifact.sh:34-74, with additional dependency installation at scripts/init-artifact.sh:260-261
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# Check if pnpm is installed
if ! command -v pnpm &> /dev/null; then
  echo "📦 pnpm not found. Installing pnpm..."
  npm install -g pnpm
fi

# Create new Vite project (always use latest create-vite, pin vite version later)
pnpm create vite "$PROJECT_NAME" --template react-ts

# Navigate into project directory
cd "$PROJECT_NAME"

echo "📦 Installing base dependencies..."
pnpm install

# Pin Vite version for Node 18
if [ "$NODE_VERSION" -lt 20 ]; then
  echo "📌 Pinning Vite to $VITE_VERSION for Node 18 compatibility..."
  pnpm add -D vite@$VITE_VERSION
fi

echo "📦 Installing Tailwind CSS and dependencies..."
pnpm install -D tailwindcss@3.4.1 postcss autoprefixer @types/node tailwindcss-animate
pnpm install class-variance-authority clsx tailwind-merge lucide-react next-themes

Additional unpinned packages are installed later:

bash

pnpm install @radix-ui/react-accordion @radix-ui/react-aspect-ratio @radix-ui/react-avatar @radix-ui/react-checkbox @radix-ui/react-collapsible @radix-ui/react-context-menu @radix-ui/react-dialog @radix-ui/react-dropdown-menu @radix-ui/react-hover-card @radix-ui/react-label @radix-ui/react-menubar @radix-ui/react-navigation-menu @radix-ui/react-popover @radix-ui/react-progress @radix-ui/react-radio-group @radix-ui/react-scroll-area @radix-ui/react-select @radix-ui/react-separator @radix-ui/react-slider @radix-ui/react-slot @radix-ui/react-switch @radix-ui/react-tabs @radix-ui/react-toast @radix-ui/react-toggle @radix-ui/react-toggle-group @radix-ui/react-tooltip
pnpm install sonner cmdk vaul embla-carousel-react react-day-picker react-resizable-panels date-fns react-hook-form @hookform/resolvers zod

...[truncated 1938 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency and executable package to an exact, reviewed version rather than using latest or implicit version ranges.
2. Commit a reviewed pnpm-lock.yaml and install with:

   bash

   pnpm install --frozen-lockfile
   

3. Avoid automatically installing a global package manager. Require a documented, preinstalled version or use Corepack with a pinned packageManager declaration.
4. Replace pnpm create vite with a pinned invocation, such as a reviewed exact create-vite version.
5. Where operationally feasible, disable lifecycle scripts during installation and explicitly allow only packages that require reviewed installation scripts.
6. Configure an approved registry and use package integrity verification, dependency scanning, and periodic lockfile review.
7. Run initialization without administrative privileges and in an isolated workspace or container.

T08 · Insecure Dependencies

Warning

• Location: scripts/bundle-artifact.sh:17

Finding

Bundling installs mutable build dependencies immediately before executing them

Content

View full analysis

Vulnerability Details

File Location: scripts/bundle-artifact.sh:17-19, followed by execution at scripts/bundle-artifact.sh:40-44
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install bundling dependencies
echo "📦 Installing bundling dependencies..."
pnpm add -D parcel @parcel/config-default parcel-resolver-tspaths html-inline

The newly resolved tools are subsequently executed:

bash

# Build with Parcel
echo "🔨 Building with Parcel..."
pnpm exec parcel build index.html --dist-dir dist --no-source-maps

# Inline everything into single HTML
echo "🎯 Inlining all assets into single HTML file..."
pnpm exec html-inline dist/index.html > bundle.html

Technical Analysis

The bundling script resolves parcel, @parcel/config-default, parcel-resolver-tspaths, and html-inline without exact versions every time it is run. It then executes the resulting Parcel and html-inline binaries in the current project.

This combines mutable dependency resolution with immediate execution. A malicious or compromised package release can therefore affect both the local build environment and the generated bundle.html. The absence of frozen lockfile enforcement also means two users can execute materially different code while following the same documented workflow.

Attack Path

1. An attacker publishes or causes resolution of a malicious compatible release of a bundling package or transitive dependency.
2. A user runs scripts/bundle-artifact.sh from a project directory.
3. pnpm add -D downloads the malicious package and may execute its lifecycle scripts.
4. The script invokes the installed parcel and html-inline executables.
5. The malicious code executes as the invoking user and may also inject content into the generated HTML artifact.
6. If the resulting artifact is shared, injected client-side behavior can be propagated to a ...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare exact, reviewed versions of all bundling tools in the generated project template.
2. Generate and preserve a lockfile, then use pnpm install --frozen-lockfile instead of adding mutable dependencies during every build.
3. Separate dependency provisioning from artifact generation so builds do not modify dependency manifests or resolve new versions.
4. Execute only locally pinned package binaries from the locked dependency graph.
5. Scan dependencies and generated HTML in CI, including checks for unexpected external URLs and injected scripts.
6. Perform builds in a restricted container without access to developer credentials or unrelated host files.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/init-artifact.sh:61

Finding

Unescaped project name is interpolated into a sed program

Content

View full analysis

Vulnerability Details

File Location: scripts/init-artifact.sh:61-62
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code

bash

$SED_INPLACE '/<link rel="icon".*vite\.svg/d' index.html
$SED_INPLACE 's/<title>.*<\/title>/<title>'"$PROJECT_NAME"'<\/title>/' index.html

The value originates from the first command-line argument:

bash

PROJECT_NAME="$1"

Technical Analysis

Shell quoting prevents ordinary shell word splitting and direct shell metacharacter expansion at the interpolation point, but it does not make PROJECT_NAME safe as sed syntax. The value is inserted into the replacement expression without escaping sed delimiters, backslashes, ampersands, or control characters.

A crafted value can terminate or alter the replacement expression, introduce additional sed syntax on implementations that accept embedded newlines and commands, or cause initialization to fail. Exploitability for command execution depends on the sed implementation and on whether the upstream Vite scaffolder accepts the crafted project name. At minimum, malformed project names can corrupt the generated title or trigger a denial of service.

Attack Path

1. An attacker causes a user or automation system to invoke the script with a crafted project-name argument containing sed metacharacters or control characters.
2. The argument is safely passed as a shell argument to Vite and cd, but is later concatenated into the sed program as executable sed syntax.
3. Sed parses attacker-controlled characters as part of its program rather than solely as replacement data.
4. The operation fails, corrupts index.html, or—where a compatible sed command-injection construction and accepted project name are available—executes an injected sed command.
5. Any injected command would run with the invoking user's privileges.

Impact Assessment

The reliably d ...[truncated 408 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct a sed program using untrusted input. Use a data-aware tool, for example a small Node.js script that reads the file and inserts a safely encoded text value.
2. Validate project names against a strict allowlist before use, such as letters, digits, underscores, and hyphens only.
3. Reject newlines, carriage returns, control characters, path separators, and sed metacharacters.
4. If sed must be retained, escape at least backslashes, ampersands, the selected delimiter, and line terminators before interpolation.
5. Pass the project title through an environment variable or file and have the editing program treat it strictly as data.
6. Add regression tests using project names containing /, \, &, newlines, and leading hyphens.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs the agent to run local shell scripts that can install packages and modify files, but it does not warn that these actions change the environment or may execute third-party dependency lifecycle scripts. In this context, blindly following the instructions could lead to unintended code execution through npm install flows or unexpected repository changes, especially if the skill or referenced scripts are adversarial or have been tampered with.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.