The Agent Skills Directory

Sensitive Data Access: The skill instructions involve searching for and reading environment variables and local .env files to locate VERCEL_TOKEN and other project identifiers. Accessing files that contain sensitive secrets is a security consideration, although it is required for authenticating with the Vercel platform as described in the skill's purpose.
External Tool Installation: The skill includes instructions to install the Vercel CLI using npm install -g vercel. This process downloads code from the official npm registry. Because it targets a well-known tool from a recognized service provider, it is a standard practice for this workflow.
Command Execution: The instructions guide the agent to run various shell commands, including vercel deploy, git push, and export. These commands are used to manage project state and perform network operations. While appropriate for cloud project management, these actions should be monitored to ensure they align with intended tasks.
Indirect Prompt Injection Surface: The skill extracts information from external sources like project URLs and local configuration files. This data ingestion creates a surface where malformed input could potentially influence the agent's execution logic. The skill lacks explicit boundary markers or sanitization for this external data, though it does include recommendations for user approval before significant actions like git pushes.

vercel-cli-with-tokens