Artifacts Builder

• Analyzed: May 12, 2026, 4:29 AM
• Findings: 1
• Version: 0.1.0
• Hash: 675bb3d98c6cb73b4e04a7715e93dd213a3ef019e6c0149457d6f5f925176dfd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's `SKILL.md` instructions appear benign and align with the stated purpose of building frontend artifacts, with no evidence of prompt injection attempts. However, the agent is instructed to execute local shell scripts (`scripts/init-artifact.sh`, `scripts/bundle-artifact.sh`) whose content is not provided for review. This constitutes a risky capability (arbitrary code execution via shell scripts) where the specific implementation details are opaque, preventing a full security assessment and introducing an unverified attack surface.