landing-page-vercel
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/scaffold.py) that creates a project directory and writes various configuration and source files (index.html, styles.css, script.js, data.json, vercel.json, README.md) to the local filesystem. - [DATA_EXFILTRATION]: No unauthorized exfiltration detected. The skill generates code for form handling that submits to
formspree.ioor a custom endpoint, which is the documented and intended behavior for an email capture landing page. - [EXTERNAL_DOWNLOADS]: The instructions suggest using the
vercelCLI for deployment, which is an official tool from a well-known service. - [SAFE]: No hardcoded credentials, obfuscation, or malicious persistence mechanisms were found.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text (product name, tagline, features) in Phase 1 to generate code via
scripts/scaffold.py. While no specific boundary markers or sanitization steps are defined in the workflow instructions, this behavior is central to the tool's primary purpose as a scaffold generator.
Audit Metadata