vercel-optimize
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Command Execution: The skill interacts with the Vercel platform by executing official
vercelCLI commands. This behavior is documented and necessary for retrieving deployment metrics, billing usage, and project configurations used to generate optimization reports. - Telemetry Data Handling: The skill processes project telemetry and configuration data. It includes a dedicated redaction utility in
lib/vercel.mjsdesigned to mask sensitive strings—such as authentication tokens and internal project or account identifiers—from appearing in logs or the AI's conversational output. - Deterministic Scope Gates: The skill employs deterministic JavaScript logic to evaluate production metrics before allowing the AI to inspect source code. This 'candidate-bound' approach ensure that analysis is limited to files associated with observed performance or cost signals, preventing unnecessary codebase exposure.
- Automated Claim Verification: A verification framework (
lib/verify-claim.mjs) validates the AI's recommendations against actual project files and official documentation. This helps ensure that proposed changes are factually grounded and compatible with the specific version of the project's framework. - Official Resource Integration: All external references, including the Vercel CLI and documentation links, originate from official domains and repositories associated with the platform ecosystem.
Audit Metadata