NYC

vercel-deploy

Pass

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS] (LOW): The skill performs network operations (via curl) to an external endpoint at claude-skills-deploy.vercel.com. Per the [TRUST-SCOPE-RULE], since Vercel is a trusted organization, this external communication is downgraded to LOW severity.
  • [DATA_EXFILTRATION] (SAFE): While the skill uploads local project files to a remote server, this is the primary and intended function of the deployment skill. The destination is a trusted service provider, and the script proactively excludes sensitive version control metadata (.git) from the upload.
  • [COMMAND_EXECUTION] (SAFE): The deploy.sh script uses standard system utilities like tar and curl to manage project files. All variables used in command lines are properly double-quoted to prevent shell injection or whitespace-related errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 17, 2026, 05:21 PM