deploy-vercel

Pass

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the official vercel CLI package from the public npm registry, which is a well-known and trusted service provider for cloud deployments.
  • [COMMAND_EXECUTION]: Runs standard build and deployment commands such as npm install, npm run build, and vercel --prod to finalize the shipping process. These operations are necessary for the skill's stated goal and are standard for development workflows.
  • [PROMPT_INJECTION]: Ingests project configuration data to determine deployment parameters, which is an inherent and required part of the deployment process. 1. Ingestion points: Reads configuration from local files like package.json and vercel.json to identify project requirements (SKILL.md). 2. Boundary markers: Does not utilize specific markers to isolate ingested content from system instructions. 3. Capability inventory: Includes shell execution of build scripts and CLI-based project management (SKILL.md). 4. Sanitization: No sanitization is performed on the data read from project files, relying on the user to provide valid configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 3, 2026, 12:55 PM