Turns agent output into versioned web pages, PDFs, Word docs, spreadsheets and Markdown.
Risky behavior the analysis could not rule out.
. Suspicious.cursor/skills/artifactsmith-security-checklist No issues found.cursor/skills/security-best-practices No issues found.cursor/skills/security-threat-model SuspiciousThe undeclared env vars ARTIFACTSMITH_OA_URL and ARTIFACTSMITH_OA_SHA (and the TOB equivalents) let the upstream repo and pin be redirected away from the official openai/skills commit, so an attacker who controls the environment could substitute the fetched instruction content.
readonly OA_URL="${ARTIFACTSMITH_OA_URL:-https://github.com/openai/skills.git}"What the analysis could not settle from the code alone.
What it calls, runs, installs, reads and writes, with the line that does it.
GitHub repositories it links to or installs from, and whether their names can be taken over.
Candidates the review stage examined and rejected, kept for transparency.
The attribution doc directs the agent/user to run a fetch script to pull companion reference files from upstream rather than shipping them, making instructions loaded into context mutable remote content.
`bash .cursor/skills/fetch-upstream.sh openai-best-practices`
The doc openly declares that references are fetched by the script, and the script pins the official openai/skills commit. This is declared, pinned retrieval of upstream content, not hidden mutable content.
The skill instructs the agent to run a bundled script at skill runtime that fetches reference content from remote upstream sources (not shipped in the repo), and the agent then loads and follows those fetched instructions, so behavior depends on remote content.
REFS=$(bash .cursor/skills/fetch-upstream.sh openai-best-practices)
The run-time fetch is declared in SKILL.md and pinned to a fixed official commit SHA, so the fetched references are immutable upstream content rather than mutable remote instructions.
SKILL.md states that it fetches companion references at run time by executing a shell script, an auto-run step outside the user's task whose content and network behavior are not visible in this unit.
This copy fetches companion `references/` at run time with `bash .cursor/skills/fetch-upstream.sh`
The line declares the fetch script openly, and the script is shipped and visible with pinned defaults. There is no concealed or undeclared execution.
The skill tells the agent to run a helper script that fetches the prompt template from upstream at run time, then to follow that fetched file's output contract, so the agent's instructions come from content outside the artifact.
TM=$(bash .cursor/skills/fetch-upstream.sh openai-threat-model)
The fetch of the prompt template is declared in SKILL.md and pinned to a fixed official openai/skills commit, so the instructions are not mutable remote content.
The script fetches upstream skill trees from GitHub at run time, and the repository URLs and pinned commit SHAs can be overridden through environment variables, so the fetched skill instructions and scripts could come from a redirected source.
readonly TOB_URL="${ARTIFACTSMITH_TOB_URL:-https://github.com/trailofbits/skills.git}"The default is a pinned commit SHA of the official upstream repo. Overriding the URL needs control of the local environment, which already gives an attacker more power than the override does.
Undeclared environment variables (ARTIFACTSMITH_OA_URL, ARTIFACTSMITH_OA_SHA, and the TOB equivalents) let the upstream repo URL and commit pin be redirected to an arbitrary source. Whatever that source returns is then loaded as skill instructions. The defaults are pinned and the override is not documented to users.
ARTIFACTSMITH_OA_URL:-https://github.com/openai/skills.git
The OA defaults are pinned to a specific official commit. The env override is an operator-controlled configuration knob, not an attacker-reachable path or concealed behavior.
Shared HTML pages get a credit footer appended at serve time, styled with inline !important so page CSS cannot hide it, so viewers see content the page author did not write.
Inline !important beats a page rule that hides footer, a, or this id.
This is a documented, toggleable branding footer on the share view, not deceptive or harmful manipulation. Stored bytes are unchanged and the visible text is just the product name linked to the repo.
When a configuration flag is on, shared HTML pages are modified at serve time by injecting a branding footer with forced !important styles so page rules cannot hide it; this is a documented, toggleable credit line and appears to be benign branding.
footer = f'<footer id="{CREDIT_ID}" style="{_FOOTER_STYLE}">{link}</footer>'The footer is an openly named, config-gated credit line and the finding itself calls it benign branding. It is neither concealed nor harmful.
Parts of the artifact the static analysis could not fully examine.
manifest_unparseable yaml: YAML aliases are not permitted