vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- Command Execution: The skill utilizes a bash script to handle the deployment lifecycle. It uses standard system utilities to manage temporary directories, package files, and communicate with the deployment API.
- Evidence:
- Use of
tarfor creating project archives. - Use of
curlto transmit data to the deployment endpoint. - Use of
findandmvfor project structure normalization. - Data Transfer for Deployment: To perform its function, the skill bundles the specified project directory and uploads it to a Vercel-owned deployment service. This is the intended behavior for an automated deployment tool.
- Evidence:
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"is used as the target for project uploads.- Sensitive Data Handling: The deployment script includes specific logic to exclude sensitive or bulky directories from being uploaded, which is a positive security practice.
- Evidence:
- The packaging command explicitly excludes
node_modulesand.gitdirectories:tar -czf "$TARBALL" -C "$PROJECT_PATH" --exclude='node_modules' --exclude='.git' .
Audit Metadata