Skills/ClawHub/artifacts-builder

artifacts-builder@1.0.0

VERIFIED

Publisher claims: "Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher javotillo · joined 6 days agoInstalls 316Last detonated 3 h ago
$clawhub install artifacts-builder
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Archive committed in an agent bundlescripts/shadcn-components.tar.gz: agents install from source, not from a committed ZIP; this is how installer lures ship their payloadFix: Pin versions and sources; vendor anything fetched at install time.
AST06

No other findings across 711 lines in 6 files.

Cost to the agent

Not measured yet; benchmarks are collected with each run since November 5, 2026. See the MCP server benchmarks.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.