Skills artifacts-builder

📦

artifacts-builder

Name: artifacts-builder
Author: DYAI2025

Content revision r1 Medium Risk ⚙️ External commands⚡ Contains scripts🌐 Network access📁 Filesystem access

Build React HTML Artifacts

Complex HTML artifacts need project structure, reusable components, and reliable bundling. This skill creates a React workspace and packages it into one HTML artifact for Claude conversations.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "artifacts-builder" from https://skillstore.io/skills/dyai2025-artifacts-builder.md and its manifest at https://skillstore.io/api/skills/dyai2025-artifacts-builder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dyai2025-artifacts-builder.md Signed manifest GET /api/skills/dyai2025-artifacts-builder/manifest Signed lockfile GET /api/skills/dyai2025-artifacts-builder/lockfile

Test it

Using "artifacts-builder". Create a project for an analytics dashboard artifact.

Expected outcome:

A React and TypeScript workspace is created with Tailwind styling, shadcn/ui components, path aliases, and development commands.

Using "artifacts-builder". Bundle the finished project for Claude.

Expected outcome:

A single HTML artifact is produced with application scripts, styles, and assets inlined for sharing in a conversation.

Using "artifacts-builder". Add a component-based interface with dialogs and tables.

Expected outcome:

The artifact uses installed UI components to provide structured navigation, actions, forms, and responsive data views.

Security Audit

Medium Risk

v9 • 7/9/2026 Open versioned report

The skill is a legitimate frontend artifact builder, but it runs shell scripts with package installation and file-system side effects. Most markdown, URL, and local configuration findings are false positives; the remaining concerns are supply-chain exposure, global package installation, and a packaged component archive that reduces reviewability.

Files scanned

653

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

scripts/init-artifact.sh:33-37 scripts/init-artifact.sh:58-79 scripts/init-artifact.sh:270-273 scripts/bundle-artifact.sh:19-21

Runtime Package Installation from Public Registries

The initializer and bundler install packages during execution, including global pnpm installation when missing and frontend dependencies from npm or pnpm registries. This creates supply-chain and environment modification risk even though it appears related to the skill purpose.

The package installation commands are explicit and occur automatically as part of normal setup and bundling. The risk is supply-chain exposure, not evidence of malicious intent.

Medium

scripts/init-artifact.sh:275-277

Packaged Component Archive Extracted into Source

The setup script extracts shadcn-components.tar.gz into the generated src directory. The archive listing contains expected relative component paths, but the archive format can hide source contents from normal text review and lacks checksum validation.

The extraction command and bundled archive are present, and the archive is part of the published skill. Manual listing reduced concern about path traversal, but the package remains less reviewable than plain source files.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/bundle-artifact.sh:1

Unix shell invocation

#!/bin/bash

This is an executable shell script that installs bundling dependencies, deletes generated build outputs, and runs Parcel commands. Those are legitimate actions, but they create external command and workspace side effects.

Medium

scripts/init-artifact.sh:1

Unix shell invocation

#!/bin/bash

This shell script creates a project, installs dependencies, writes configuration files, and extracts an archive. The behavior is intentional, but it has real execution and workspace modification risk.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dyai2025-artifacts-builder/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dyai2025-artifacts-builder/security.svg)](https://skillstore.io/skills/dyai2025-artifacts-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dyai2025-artifacts-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dyai2025-artifacts-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dyai2025-artifacts-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DYAI2025. (2026). artifacts-builder security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dyai2025-artifacts-builder/audits/9

BibTeX citation

@techreport{dyai2025-dyai2025-artifacts-builder-2026,
  author = {DYAI2025},
  title = {artifacts-builder security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dyai2025-artifacts-builder/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "artifacts-builder security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "DYAI2025"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dyai2025-artifacts-builder/audits/9"
identifiers:
  - type: other
    value: "skillstore:dyai2025-artifacts-builder:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

5 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

davila7 Recommended

davila7-artifacts-builder

Skillstore Score 67

Evidence Confidence High

Skillstore usage 6

Updated

2026-08-21

Cam10001110101

cam10001110101-artifacts-builder

Skillstore Score 66

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

DYAI2025 Current

dyai2025-artifacts-builder

Skillstore Score 50

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

ComposioHQ

composiohq-artifacts-builder

Skillstore Score 50

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

ArtemisAI

artemisai-artifacts-builder

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build Interactive Prototypes

Create a structured React prototype with state, components, and styling for review in a Claude conversation.

Prepare Rich Demo Artifacts

Generate a frontend project and bundle it into one HTML file for sharing or demonstration.

Start Component-Based Experiments

Use a ready Tailwind and shadcn/ui setup when an artifact needs dialogs, forms, tables, or navigation.

Try These Prompts

Create a Basic Artifact

Use artifacts-builder to create a React artifact project named dashboard-demo. Keep the first version simple and explain the generated files.

Build with shadcn/ui

Use artifacts-builder to create a task management artifact with tabs, cards, dialogs, and a responsive table using shadcn/ui components.

Bundle for Sharing

Use artifacts-builder to bundle my current React artifact project into a single HTML file and summarize what changed during bundling.

Create a Production-Style Prototype

Use artifacts-builder to create a multi-view analytics artifact with realistic state, accessible controls, responsive layout, and a final bundled HTML output.

Best Practices

Review shell scripts before running them in a workspace with important files.
Use the skill for artifacts that need component structure or build tooling.
Bundle only after the artifact runs correctly in the generated project.

Avoid

Do not use this skill for a tiny static HTML response.
Do not run the scripts in a directory where package changes are unexpected.
Do not publish bundled output before reviewing installed dependencies and generated files.