vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The skill performs network operations (via
curl) to an external endpoint atclaude-skills-deploy.vercel.com. Per the [TRUST-SCOPE-RULE], since Vercel is a trusted organization, this external communication is downgraded to LOW severity. - [DATA_EXFILTRATION] (SAFE): While the skill uploads local project files to a remote server, this is the primary and intended function of the deployment skill. The destination is a trusted service provider, and the script proactively excludes sensitive version control metadata (
.git) from the upload. - [COMMAND_EXECUTION] (SAFE): The
deploy.shscript uses standard system utilities liketarandcurlto manage project files. All variables used in command lines are properly double-quoted to prevent shell injection or whitespace-related errors.
Audit Metadata