The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill instructs the agent to inspect vc-build logs during forensic auditing. This introduces a surface for indirect prompt injection if malicious or untrusted build processes produce output designed to influence the agent's logic.\n
Ingestion points: vc-build logs referenced in the troubleshooting section.\n
Boundary markers: Absent; no instructions are provided to the agent to treat log content as untrusted data.\n
Capability inventory: Includes deployment via bun x vercel, environment sync via vercel env pull, and dependency installation via bun install.\n
Sanitization: Absent; logs are processed as raw text.\n- External Downloads (LOW): The skill uses bun install and bun x to download and execute tools like vercel, next, and lighthouse. While these come from trusted organizations (Vercel, Google), the reliance on external package execution is categorized as LOW per the Trusted External Source rule.\n- Data Exposure (SAFE): The command bun x vercel env pull .env.local is used for environment synchronization. While this handles sensitive secrets, it is an intended function of the synchronization role using official tooling.

vercel-sync