deploy-vercel
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official
vercelCLI package from the public npm registry, which is a well-known and trusted service provider for cloud deployments. - [COMMAND_EXECUTION]: Runs standard build and deployment commands such as
npm install,npm run build, andvercel --prodto finalize the shipping process. These operations are necessary for the skill's stated goal and are standard for development workflows. - [PROMPT_INJECTION]: Ingests project configuration data to determine deployment parameters, which is an inherent and required part of the deployment process. 1. Ingestion points: Reads configuration from local files like
package.jsonandvercel.jsonto identify project requirements (SKILL.md). 2. Boundary markers: Does not utilize specific markers to isolate ingested content from system instructions. 3. Capability inventory: Includes shell execution of build scripts and CLI-based project management (SKILL.md). 4. Sanitization: No sanitization is performed on the data read from project files, relying on the user to provide valid configuration.
Audit Metadata