Web Artifacts Builder Anthropic

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:18 AM UTC
• Version: 1.0.0

Overview

This skill is a transparent web-app artifact builder, but it relies on normal JavaScript package-install workflows that users should run in an isolated project.

Install only if you are comfortable running local shell scripts that create project files and install JavaScript dependencies. Use a disposable workspace or container, avoid running with elevated privileges, inspect the scripts first, and consider pinning dependencies or using a lockfile for repeatable builds. Note that the inspected package references shadcn-components.tar.gz, but that file was not present in the workspace, so initialization may fail unless the package is completed elsewhere.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/init-artifact.sh:34
• Finding: Unpinned third-party packages are downloaded and executed during project initialization## Vulnerability Details **File Location**: `scripts/init-artifact.sh:34-74`, with additional dependency installation at `scripts/init-artifact.sh:260-261` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Check if pnpm is installed if ! command -v pnpm &> /dev/null; then echo "📦 pnpm not found. Installing pnpm..." npm install -g pnpm fi # Create new Vite project (always use latest create-vite, pin vite version later) pnpm create vite "$PROJECT_NAME" --template react-ts # Navigate into project directory cd "$PROJECT_NAME" echo "📦 Installing base dependencies..." pnpm install # Pin Vite version for Node 18 if [ "$NODE_VERSION" -lt 20 ]; then echo "📌 Pinning Vite to $VITE_VERSION for Node 18 compatibility..." pnpm add -D vite@$VITE_VERSION fi echo "📦 Installing Tailwind CSS and dependencies..." pnpm install -D tailwindcss@3.4.1 postcss autoprefixer @types/node tailwindcss-animate pnpm install class-variance-authority clsx tailwind-merge lucide-react next-themes ``` Additional unpinned packages are installed later: ```bash pnpm install @radix-ui/react-accordion @radix-ui/react-aspect-ratio @radix-ui/react-avatar @radix-ui/react-checkbox @radix-ui/react-collapsible @radix-ui/react-context-menu @radix-ui/react-dialog @radix-ui/react-dropdown-menu @radix-ui/react-hover-card @radix-ui/react-label @radix-ui/react-menubar @radix-ui/react-navigation-menu @radix-ui/react-popover @radix-ui/react-progress @radix-ui/react-radio-group @radix-ui/react-scroll-area @radix-ui/react-select @radix-ui/react-separator @radix-ui/react-slider @radix-ui/react-slot @radix-ui/react-switch @radix-ui/react-tabs @radix-ui/react-toast @radix-ui/react-toggle @radix-ui/react-toggle-group @radix-ui/react-tooltip pnpm install sonner cmdk vaul embla-carousel-react react-day-picker react-resizable-panels date-fns react-hook-form @hookform/resolvers zod ``` ### ...[truncated 1938 chars]
• Remediation: ## Remediation Suggestions 1. Pin every direct dependency and executable package to an exact, reviewed version rather than using `latest` or implicit version ranges. 2. Commit a reviewed `pnpm-lock.yaml` and install with: ```bash pnpm install --frozen-lockfile ``` 3. Avoid automatically installing a global package manager. Require a documented, preinstalled version or use Corepack with a pinned `packageManager` declaration. 4. Replace `pnpm create vite` with a pinned invocation, such as a reviewed exact `create-vite` version. 5. Where operationally feasible, disable lifecycle scripts during installation and explicitly allow only packages that require reviewed installation scripts. 6. Configure an approved registry and use package integrity verification, dependency scanning, and periodic lockfile review. 7. Run initialization without administrative privileges and in an isolated workspace or container.

T08 · Insecure Dependencies

Warning

• Location: scripts/bundle-artifact.sh:17
• Finding: Bundling installs mutable build dependencies immediately before executing them## Vulnerability Details **File Location**: `scripts/bundle-artifact.sh:17-19`, followed by execution at `scripts/bundle-artifact.sh:40-44` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install bundling dependencies echo "📦 Installing bundling dependencies..." pnpm add -D parcel @parcel/config-default parcel-resolver-tspaths html-inline ``` The newly resolved tools are subsequently executed: ```bash # Build with Parcel echo "🔨 Building with Parcel..." pnpm exec parcel build index.html --dist-dir dist --no-source-maps # Inline everything into single HTML echo "🎯 Inlining all assets into single HTML file..." pnpm exec html-inline dist/index.html > bundle.html ``` ### Technical Analysis The bundling script resolves `parcel`, `@parcel/config-default`, `parcel-resolver-tspaths`, and `html-inline` without exact versions every time it is run. It then executes the resulting Parcel and `html-inline` binaries in the current project. This combines mutable dependency resolution with immediate execution. A malicious or compromised package release can therefore affect both the local build environment and the generated `bundle.html`. The absence of frozen lockfile enforcement also means two users can execute materially different code while following the same documented workflow. ### Attack Path 1. An attacker publishes or causes resolution of a malicious compatible release of a bundling package or transitive dependency. 2. A user runs `scripts/bundle-artifact.sh` from a project directory. 3. `pnpm add -D` downloads the malicious package and may execute its lifecycle scripts. 4. The script invokes the installed `parcel` and `html-inline` executables. 5. The malicious code executes as the invoking user and may also inject content into the generated HTML artifact. 6. If the resulting artifact is shared, injected client-side behavior can be propagated to a ...[truncated 415 chars]
• Remediation: ## Remediation Suggestions 1. Declare exact, reviewed versions of all bundling tools in the generated project template. 2. Generate and preserve a lockfile, then use `pnpm install --frozen-lockfile` instead of adding mutable dependencies during every build. 3. Separate dependency provisioning from artifact generation so builds do not modify dependency manifests or resolve new versions. 4. Execute only locally pinned package binaries from the locked dependency graph. 5. Scan dependencies and generated HTML in CI, including checks for unexpected external URLs and injected scripts. 6. Perform builds in a restricted container without access to developer credentials or unrelated host files.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/init-artifact.sh:61
• Finding: Unescaped project name is interpolated into a sed program## Vulnerability Details **File Location**: `scripts/init-artifact.sh:61-62` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Low ### Vulnerable Code ```bash $SED_INPLACE '/<link rel="icon".*vite\.svg/d' index.html $SED_INPLACE 's/<title>.*<\/title>/<title>'"$PROJECT_NAME"'<\/title>/' index.html ``` The value originates from the first command-line argument: ```bash PROJECT_NAME="$1" ``` ### Technical Analysis Shell quoting prevents ordinary shell word splitting and direct shell metacharacter expansion at the interpolation point, but it does not make `PROJECT_NAME` safe as sed syntax. The value is inserted into the replacement expression without escaping sed delimiters, backslashes, ampersands, or control characters. A crafted value can terminate or alter the replacement expression, introduce additional sed syntax on implementations that accept embedded newlines and commands, or cause initialization to fail. Exploitability for command execution depends on the sed implementation and on whether the upstream Vite scaffolder accepts the crafted project name. At minimum, malformed project names can corrupt the generated title or trigger a denial of service. ### Attack Path 1. An attacker causes a user or automation system to invoke the script with a crafted project-name argument containing sed metacharacters or control characters. 2. The argument is safely passed as a shell argument to Vite and `cd`, but is later concatenated into the sed program as executable sed syntax. 3. Sed parses attacker-controlled characters as part of its program rather than solely as replacement data. 4. The operation fails, corrupts `index.html`, or—where a compatible sed command-injection construction and accepted project name are available—executes an injected sed command. 5. Any injected command would run with the invoking user's privileges. ### Impact Assessment The reliably d ...[truncated 408 chars]
• Remediation: ## Remediation Suggestions 1. Do not construct a sed program using untrusted input. Use a data-aware tool, for example a small Node.js script that reads the file and inserts a safely encoded text value. 2. Validate project names against a strict allowlist before use, such as letters, digits, underscores, and hyphens only. 3. Reject newlines, carriage returns, control characters, path separators, and sed metacharacters. 4. If sed must be retained, escape at least backslashes, ampersands, the selected delimiter, and line terminators before interpolation. 5. Pass the project title through an environment variable or file and have the editing program treat it strictly as data. 6. Add regression tests using project names containing `/`, `\`, `&`, newlines, and leading hyphens.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs the agent to run local shell scripts that can install packages and modify files, but it does not warn that these actions change the environment or may execute third-party dependency lifecycle scripts. In this context, blindly following the instructions could lead to unintended code execution through npm install flows or unexpected repository changes, especially if the skill or referenced scripts are adversarial or have been tampered with.

Static analysis

No suspicious patterns detected.