vercel-optimize

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Command Execution: The skill interacts with the Vercel platform by executing official vercel CLI commands. This behavior is documented and necessary for retrieving deployment metrics, billing usage, and project configurations used to generate optimization reports.
  • Telemetry Data Handling: The skill processes project telemetry and configuration data. It includes a dedicated redaction utility in lib/vercel.mjs designed to mask sensitive strings—such as authentication tokens and internal project or account identifiers—from appearing in logs or the AI's conversational output.
  • Deterministic Scope Gates: The skill employs deterministic JavaScript logic to evaluate production metrics before allowing the AI to inspect source code. This 'candidate-bound' approach ensure that analysis is limited to files associated with observed performance or cost signals, preventing unnecessary codebase exposure.
  • Automated Claim Verification: A verification framework (lib/verify-claim.mjs) validates the AI's recommendations against actual project files and official documentation. This helps ensure that proposed changes are factually grounded and compatible with the specific version of the project's framework.
  • Official Resource Integration: All external references, including the Vercel CLI and documentation links, originate from official domains and repositories associated with the platform ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:42 AM
Security Audit — agent-trust-hub — vercel-optimize