vercel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill provides various curl commands and instructions to use npx for starting a local emulator service. These tools are used to interact with a local development server (localhost:4000) and are standard for the skill's purpose of API testing and service emulation.
- External Package Management: The skill references npx emulate and the @vercel/blob SDK, which involves fetching packages from a public registry. As these are core components for creating a local Vercel-like environment, they are considered routine and expected operations for development tasks.
- Indirect Prompt Injection Surface: The skill provides examples where user inputs are used to construct API requests and command arguments. While this is necessary for an API tool, it represents a surface where input handling should be managed to ensure commands are processed correctly.
- Ingestion points: User-provided values for authentication tokens, project settings, and API payloads.
- Boundary markers: None identified in the skill content.
- Capability inventory: Bash tool for curl and npx execution.
- Sanitization: Not explicitly detailed, which is typical for developer-focused emulation tools.
- Local Test Credentials: The documentation includes placeholder tokens and secrets (e.g., test_token_admin) for use with the local emulator. These are identifiers for development use in an isolated environment and do not involve sensitive production credentials.
Audit Metadata